CVE-2020-12884: Critical severity arm mbed vulnerability

A buffer over-read was discovered in the CoAP library in Arm Mbed OS 5.15.3. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparsemultipleoptions() parses CoAP options that may occur multiple consecutive times in a single packet. While processing the options, packetdatapptr is accessed after being incremented by optionlen without a prior out-of-bounds memory check. The tempparseduriqueryptr is validated for a correct range, but the range valid for tempparseduriqueryptr is derived from the amount of allocated heap memory, not the actual input size. Therefore the check of tempparseduriqueryptr may be insufficient for safe access to the area pointed to by packetdatapptr. As a result, access to a memory area outside of the intended boundary of the packet buffer is made.