[Coverity CID :219646] Untrusted value as argument in subsys/net/lib/coap/coap.c

[zephyrbot]

Static code scan issues found in file:

https://github.com/zephyrproject-rtos/zephyr/tree/bd97359a5338b2542d19011b6d6aa1d8d1b9cc3f/subsys/net/lib/coap/coap.c

Category: Insecure data handling
Function: coap_reply_init
Component: Networking
CID: 219646

Details:

zephyr/subsys/net/lib/coap/coap.c

Line 1333 in bd97359

age = coap_get_option_int(request, COAP_OPTION_OBSERVE);

Please fix or provide comments in coverity using the link:

https://scan9.coverity.com/reports.htm#v32951/p12996.

Note: This issue was created automatically. Priority was set based on classification
of the file affected and the impact field in coverity. Assignees were set using the CODEOWNERS file.

[rlubos]

False positive.

Coverity says that Calling function parse_option with tainted argument *cpkt->data taints offset. That's not the case, because the offset value is incremented by the value of the decoded option length, and it's verified that the decoded option length does not exceed the boundaries of the packet received (https://github.com/zephyrproject-rtos/zephyr/blob/master/subsys/net/lib/coap/coap.c#L400).