sys/net/nanocoap: fix possible option_count overflow

MxMalk · Jan 14, 2019 · 4b1b0aa · 4b1b0aa
1 parent dd53bb8
commit 4b1b0aa
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/sys/net/application_layer/nanocoap/nanocoap.c b/sys/net/application_layer/nanocoap/nanocoap.c
@@ -106,6 +106,11 @@ int coap_parse(coap_pkt_t *pkt, uint8_t *buf, size_t len)
  DEBUG("option count=%u nr=%u len=%i\n", option_count, option_nr, option_len);
 
  if (option_delta) {
+ if (option_count >= NANOCOAP_NOPTS_MAX) {
+ DEBUG("nanocoap: max nr of options exceeded\n");
+ return -ENOMEM;
+ }
+
  optpos->opt_num = option_nr;
  optpos->offset = (uintptr_t)option_start - (uintptr_t)hdr;
  DEBUG("optpos option_nr=%u %u\n", (unsigned)option_nr, (unsigned)optpos->offset);