CVE-2026-18416: Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)

The CoAP link-format helper matchpathuri() in subsys/net/lib/coap/coaplinkformat.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing it against the option length len. When a registered path segment is longer than the supplied URI and the URI is a prefix of it, the loop reads uri[len] and beyond, past the end of the option value.

The path is reached from coapwellknowncoregetlen() and coapwellknowncoreget() via matchqueriesresource(), i.e. by any unauthenticated GET /.well-known/core?href=/<prefix> request to a device that serves /.well-known/core (for the CoAP server subsystem, CONFIGCOAPSERVERWELLKNOWNCORE, default y) and has at least one resource that declares struct coapcoremetadata attributes.

The over-read does not reach the receive buffer. The well-known-core builders parse the query into a stack-local struct coapoption, whose value is a fixed array (value[12], or CONFIGCOAPEXTENDEDOPTIONSLENVALUE bytes) that the option bytes are copied into, so uri points into that copy. Reading past len therefore reads the unused, uninitialized tail of the array and, when the option fills it, the bytes just past it in the same stack frame. (In the ZoAP library of v1.8.0 to v1.9.x the option value was instead a pointer into the received packet, and the over-read ran past the option inside the packet buffer.)

The impact is bounded. The number of bytes read past the end is limited by the length of the resource path segment, and each additional byte is only read if it happens to equal the next path character, so in practice the over-read is one byte. It also cannot influence the response: returning a match requires the final compared index to be len - 1 or len, both in bounds, so out-of-bounds bytes only ever steer the loop to the next candidate resource. The consequence is undefined behaviour, not information disclosure and not a matching error.

The fix adds a k >= len guard at the top of the inner loop, so every uri[k] dereference is within the option value while still allowing a trailing wildcard to match a longer path.