RIOT-OS/RIOT
RIOT-OS/RIOT
1
0
Fork 0
mirror of https://github.com/RIOT-OS/RIOT.git synced 2024-12-29 04:50:03 +01:00
Code Releases Activity

gcoap: Avoid reading beyond defined input buffer

Browse Source
This commit is contained in:
chrysn 2024-04-06 11:28:03 +02:00
parent 4a4101b3b8
commit 502406dbbb
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/net/application_layer/gcoap/gcoap.c
View File

@ -1664,13 +1664,19 @@ ssize_t gcoap_req_send(const uint8_t *buf, size_t len,
switch (msg_type) { switch (msg_type) {
case COAP_TYPE_CON: case COAP_TYPE_CON:
/* Can't store it for retransmission, even though sending it from
* the provided buffer once is possible */
if (len > CONFIG_GCOAP_PDU_BUF_SIZE) {
return -EINVAL;
}
/* copy buf to resend_bufs record */ /* copy buf to resend_bufs record */
memo->msg.data.pdu_buf = NULL; memo->msg.data.pdu_buf = NULL;
for (int i = 0; i < CONFIG_GCOAP_RESEND_BUFS_MAX; i++) { for (int i = 0; i < CONFIG_GCOAP_RESEND_BUFS_MAX; i++) {
if (!_coap_state.resend_bufs[i][0]) { if (!_coap_state.resend_bufs[i][0]) {
memo->msg.data.pdu_buf = &_coap_state.resend_bufs[i][0]; memo->msg.data.pdu_buf = &_coap_state.resend_bufs[i][0];
memcpy(memo->msg.data.pdu_buf, buf, memcpy(memo->msg.data.pdu_buf, buf,
CONFIG_GCOAP_PDU_BUF_SIZE); len);
memo->msg.data.pdu_len = len; memo->msg.data.pdu_len = len;
break; break;
} }