coap: added check for block offset overflow in block2 requests.
The block offset is stored in a signed variable in calls to CoAP handlers and
too large block offsets will overflow into negative values.
Thanks to Bruno Melo for reporting this issue.
@@ -199,10 +199,18 @@ coap_receive(const coap_endpoint_t *src,
new_offset = block_offset;
}
+ if(new_offset < 0) {
+ LOG_DBG("Blockwise: block request offset overflow\n");
+ coap_status_code = BAD_OPTION_4_02;
+ coap_error_message = "BlockOutOfScope";
+ status = COAP_HANDLER_STATUS_CONTINUE;
+ } else {
/* call CoAP framework and check if found and allowed */
status = call_service(message, response,
transaction->message + COAP_MAX_HEADER_SIZE,
block_size, &new_offset);
+ }
+
if(status != COAP_HANDLER_STATUS_CONTINUE) {
if(coap_status_code == NO_ERROR) {
