From f12dfaf531c02848244782a863b188ffa0ba9094 Mon Sep 17 00:00:00 2001 From: Abtin Keshavarzian Date: Tue, 17 Sep 2024 12:14:57 -0700 Subject: [PATCH] [coap] ensure CoAP header and token length are validated (#10720) This commit updates `Coap::Message::ParseHeader()` to perform two crucial validations: - It now checks if the message contains sufficient bytes to read the minimum 4-byte CoAP header. - Afterwards, determines the CoAP token length from the read header, and then validates that the message has enough bytes to read the token. These validations prevent the parsing and misinterpretation of a malformed or incomplete CoAP message as a valid one, --- src/core/coap/coap_message.cpp | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/core/coap/coap_message.cpp b/src/core/coap/coap_message.cpp index cc82145e8..a5071f21e 100644 --- a/src/core/coap/coap_message.cpp +++ b/src/core/coap/coap_message.cpp @@ -373,7 +373,8 @@ exit: Error Message::ParseHeader(void) { - Error error = kErrorNone; + Error error = kErrorNone; + uint16_t offset = GetOffset(); Option::Iterator iterator; OT_ASSERT(GetReserved() >= @@ -381,10 +382,13 @@ Error Message::ParseHeader(void) GetHelpData().Clear(); - GetHelpData().mHeaderOffset = GetOffset(); - IgnoreError(Read(GetHelpData().mHeaderOffset, GetHelpData().mHeader)); + GetHelpData().mHeaderOffset = offset; + + SuccessOrExit(error = Read(offset, &GetHelpData().mHeader, kMinHeaderLength)); + offset += kMinHeaderLength; VerifyOrExit(GetTokenLength() <= kMaxTokenLength, error = kErrorParse); + SuccessOrExit(error = Read(offset, GetHelpData().mHeader.mToken, GetTokenLength())); SuccessOrExit(error = iterator.Init(*this));