er-coap - memory corruption in coap_parse_int_option (SIGSEGV)

[stze]

Parsing the following coap message results in a crash of contiki:

coap message hexdump:

00000000  51 51 51 00 80 51 51 51  51 4e 51 51 51 51 51 51  |QQQ..QQQQNQQQQQQ|
00000010  51 f5 06                                          |Q..|
00000013

How to reproduce:

static coap_packet_t message[1];
uint8_t teststr[] = {  0x51, 0x51, 0x51, 0x00, 0x80, 0x51, 0x51, 0x51, 0x51, 0x4e, 0x51, 0x51, 0x51, 0x51, 0x51, 0x51 };
coap_parse_message(message, (unsigned char *)teststr, sizeof(teststr));

gdb:

Program received signal SIGSEGV, Segmentation fault.
0x0000000000414f43 in coap_parse_int_option (bytes=0x7fffffffc27c "QQQQQ\365\006", length=21086) at ../../apps/er-coap/er-coap.c:92
92	    var |= bytes[i++];
(gdb) bt
#0  0x0000000000414f43 in coap_parse_int_option (bytes=0x7fffffffc27c "QQQQQ\365\006", length=21086) at ../../apps/er-coap/er-coap.c:92
#1  0x000000000041462b in coap_parse_message (packet=0x63a240 <message>, data=0x7fffffffc270 "QQQ", data_len=19) at ../../apps/er-coap/er-coap.c:546
#2  0x0000000000407788 in process_thread_er_example_client (process_pt=0x639198 <er_example_client+24>, ev=<optimized out>, data=<optimized out>) at er-example-client.c:115
#3  0x000000000041bde8 in call_process (p=0x639180 <er_example_client>, ev=129 '\201', data=0x0) at ../../core/sys/process.c:190
#4  0x000000000041b7f5 in process_post_synch (p=0x639180 <er_example_client>, ev=129 '\201', data=0x0) at ../../core/sys/process.c:366
#5  0x000000000041b7b3 in process_start (p=0x639180 <er_example_client>, data=0x0) at ../../core/sys/process.c:120
#6  0x000000000041aaeb in autostart_start (processes=0x430500 <autostart_processes>) at ../../core/sys/autostart.c:57
#7  0x000000000041a161 in main (argc=1, argv=0x7fffffffe568) at ../../platform/native/./contiki-main.c:247

valgrind:

==16577== Invalid read of size 1
==16577==    at 0x414F43: coap_parse_int_option (er-coap.c:92)
==16577==    by 0x41462A: coap_parse_message (er-coap.c:546)
==16577==    by 0x407787: process_thread_er_example_client (er-example-client.c:115)
==16577==    by 0x41BDE7: call_process (process.c:190)
==16577==    by 0x41B7F4: process_post_synch (process.c:366)
==16577==    by 0x41B7B2: process_start (process.c:120)
==16577==    by 0x41AAEA: autostart_start (autostart.c:57)
==16577==    by 0x41A160: main (contiki-main.c:247)
==16577==  Address 0xfff001000 is not stack'd, malloc'd or (recently) free'd
==16577== 
==16577== 
==16577== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==16577==  Access not within mapped region at address 0xFFF001000
==16577==    at 0x414F43: coap_parse_int_option (er-coap.c:92)
==16577==    by 0x41462A: coap_parse_message (er-coap.c:546)
==16577==    by 0x407787: process_thread_er_example_client (er-example-client.c:115)
==16577==    by 0x41BDE7: call_process (process.c:190)
==16577==    by 0x41B7F4: process_post_synch (process.c:366)
==16577==    by 0x41B7B2: process_start (process.c:120)
==16577==    by 0x41AAEA: autostart_start (autostart.c:57)
==16577==    by 0x41A160: main (contiki-main.c:247)
==16577==  If you believe this happened as a result of a stack
==16577==  overflow in your program's main thread (unlikely but
==16577==  possible), you can try to increase the size of the
==16577==  main thread stack using the --main-stacksize= flag.
==16577==  The main thread stack size used in this run was 8388608.
OPTION 14 (delta 4, len 21086): ==16577== 
==16577== HEAP SUMMARY:
==16577==     in use at exit: 0 bytes in 0 blocks
==16577==   total heap usage: 1 allocs, 1 frees, 1,024 bytes allocated
==16577== 
==16577== All heap blocks were freed -- no leaks are possible
==16577== 
==16577== For counts of detected and suppressed errors, rerun with: -v
==16577== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

The crash has been found with afl-fuzz.

Best Regards,
Stephan Zeisberg

[nvt]

PR #2249 has been merged to fix this issue. Thanks!