Bug 2275803 (CVE-2024-31031)

An issue in `coap_pdu.c` in libcoap 4.3.4 allows attackers to cause undefined behavior via a sequence of messages leading to unsigned integer overflow.

Description:
After sending a sequence of messages to the CoAP server, a runtime error was reported by UndefinedBehaviorSanitizer (UBSan). The error indicated an unsigned integer overflow occurred in coap_pdu.c at the line where an address calculation was being performed. Specifically, an unsigned offset addition to a base address resulted in an overflow, indicating that the calculated address wrapped around to a lower value than the original address. This is a sign of undefined behavior due to integer overflow during pointer arithmetic. This suggests that the resulting address calculation wrapped around, which is indicative of undefined behavior in the program.

Expected Behavior:
The server is expected to handle a sequence of incoming messages reliably without encountering arithmetic overflows or other undefined behaviors during address calculations. Memory operations should remain within their allocated bounds, and all pointer arithmetic should result in valid memory addresses that are within the expected range.

Actual Behavior:
The server exhibited undefined behavior after processing a sequence of messages, indicating a potential flaw in the address calculation within the coap_update_token function.

References:
https://github.com/obgm/libcoap/issues/1351