An integer overflow was discovered in the CoAP library in Arm Mbed OS 5.14.0. The function sncoapbuildercalcneededpacketdatasize2() is used to calculate the required memory for the CoAP message from the sncoaphdrs data structure. Both returnedbytecount and srccoapmsgptr->payloadlen are of type uint16t. When added together, the result returnedbytecount can wrap around the maximum uint16t value. As a result, insufficient buffer space is allocated for the corresponding CoAP message.

Buffer overflows were discovered in the CoAP library in Arm Mbed OS 5.14.0. The CoAP parser is responsible for parsing received CoAP packets. The function sncoapparseroptionsparse() parses CoAP input linearly using a while loop. Once an option is parsed in a loop, the current point (packetdatapptr) is increased correspondingly. The pointer is restricted by the size of the received buffer, as well as by the 0xFF delimiter byte. Inside each while loop, the check of the value of packetdatapptr is not strictly enforced. More specifically, inside a loop, packetdatapptr could be increased and then dereferenced without checking. Moreover, there are many other functions in the format of sncoapparser() that do not check whether the pointer is within the bounds of the allocated buffer. All of these lead to heap-based or stack-based buffer overflows, depending on how the CoAP packet buffer is allocated.