PelionIoT / mbed-coap

CoAP C library - Builder and Parser for CoAP messages
Apache License 2.0
29 stars 16 forks source link

Bugfix/coap parser mem access bugs #116

Closed mjurczak closed 4 years ago

mjurczak commented 4 years ago

[x] I confirm this contribution is my own and I agree to license it with Apache 2.0. [x] I confirm the moderators may change the PR before merging it in.

Summary of changes

Fixes for out-ouf-bounds memory access, memory leak and infinite loop condition in coap packets parser.

The fixed issues described in detail in the following threads: https://github.com/ARMmbed/mbed-os/issues/12957 https://github.com/ARMmbed/mbed-os/issues/12948 https://github.com/ARMmbed/mbed-os/issues/12930 https://github.com/ARMmbed/mbed-os/issues/12928 https://github.com/ARMmbed/mbed-os/issues/12927 https://github.com/ARMmbed/mbed-os/issues/12926 https://github.com/ARMmbed/mbed-os/issues/12925

Reserved CVE identifiers related to the resolved issues: CVE-2020-12886 CVE-2020-12883 CVE-2020-12884 CVE-2020-12885 CVE-2020-12887

esajaa commented 4 years ago

Hi @mjurczak,

I've been going through your pull request, and to me it seems like a good addition. I asked for a second opinion, but so far it's passing all the tests and nothing really seems out of place. I pushed some formatting fixes to the branch, hopefully that's okay to you.

I also noticed that you had few other branches in your fork. Is all the content here in this PR, or are there more pull requests incoming?

Best Regards, Esa

mjurczak commented 4 years ago

Hi @esajaa , Thanks for the formatting fixes. The content of the remaining branches in my fork is included in this single PR. I hope this is okay.

Kind regards, Maciej