From 4b1b0aa84e2ed7ba81492b0661912efb456bb0da Mon Sep 17 00:00:00 2001
From: Kaspar Schleiser <kaspar@schleiser.de>
Date: Fri, 11 Jan 2019 11:29:02 +0100
Subject: [PATCH] sys/net/nanocoap: fix possible option_count overflow
---
sys/net/application_layer/nanocoap/nanocoap.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/sys/net/application_layer/nanocoap/nanocoap.c b/sys/net/application_layer/nanocoap/nanocoap.c
index 672d31b101..455ebfe7e2 100644
--- a/sys/net/application_layer/nanocoap/nanocoap.c
+++ b/sys/net/application_layer/nanocoap/nanocoap.c
@@ -106,6 +106,11 @@ int coap_parse(coap_pkt_t *pkt, uint8_t *buf, size_t len)
DEBUG("option count=%u nr=%u len=%i\n", option_count, option_nr, option_len);
if (option_delta) {
+ if (option_count >= NANOCOAP_NOPTS_MAX) {
+ DEBUG("nanocoap: max nr of options exceeded\n");
+ return -ENOMEM;
+ }
+
optpos->opt_num = option_nr;
optpos->offset = (uintptr_t)option_start - (uintptr_t)hdr;
DEBUG("optpos option_nr=%u %u\n", (unsigned)option_nr, (unsigned)optpos->offset);
--
GitLab