PDU use after free when sending an OSCORE message with OSCORE disabled at build time about libcoap

[mrdeep1]

It looks like in the request handler doing your specific OSCORE stuff called from handle_request() for the resource defined in the CoAP PDU is releasing the response PDU's data as pointed to by response->token - response->hdr_size, but the response PDU object is still there.

This is where things start to fail

ssize_t
coap_session_send_pdu(coap_session_t *session, coap_pdu_t *pdu) {
  ssize_t bytes_written = -1;
  assert(pdu->hdr_size > 0);

  /* Caller handles partial writes */
  bytes_written = session->sock.lfunc[COAP_LAYER_SESSION].l_write(session,
                  pdu->token - pdu->hdr_size,
                  pdu->used_size + pdu->hdr_size);
  coap_show_pdu(COAP_LOG_DEBUG, pdu);
  return bytes_written;
}

where l.write is coap_netif_dgrm_write() in your case.

What does your OSCORE implementation provide that libcoap's version does not?

[rpati12]

What does your OSCORE implementation provide that libcoap's version does not?
==> We support both libcoap and openthread. We have a common oscore implementation which works on top of both these coap APIs. And this was already an old implementation we did as there was no support of OSCORE in libcoap or was in WIP.

Regarding freeing the response PDU, it looks unusual as we have not freed it explicitly. I had called it once but now I am trying after removing the delete-pdu() call. I will re-look into it and get back.

Thanks for your prompt response as always.

[mrdeep1]

As a FYI, the libcoap code picks up the OSCORE option on an inbound packet and says it is invalid in the function coap_option_check_critical() if libcoap is not running OSCORE before the PDU gets passed up to the application. However, calling coap_register_option(context, COAP_OPTION_OSCORE) allows this to be overridden.

[fun-works]

Yes, we have registered oscore option 9 to receive the oscore packets. Thanks for the information.

[fun-works]

We can close this issue as it was an issue in my code. Thanks for your support.