espressif/esp-mqtt
1
0
Fork 0
mirror of https://github.com/espressif/esp-mqtt.git synced 2026-08-31 22:30:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(mqtt5): Prevent OOB read from mqtt 5 property

Browse Source
This commit is contained in:
Euripedes Rocha Filho
2026-07-31 14:13:12 +02:00
parent 0e9ec171b4
commit bcfe1d5958
1 changed files with 28 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/mqtt5_msg.c
+28 -2
View File
@@ -374,6 +374,10 @@ char *mqtt5_get_publish_property_payload(uint8_t *buffer, size_t buffer_length,
*property_len = get_variable_len(buffer, offset, buffer_length, &len_bytes);
offset += len_bytes;
if (offset > buffer_length || *property_len > (buffer_length - offset)) {
return NULL;
}
uint16_t len = 0, property_offset = 0;
uint8_t *property = (buffer + offset);
while (property_offset < *property_len) {
@@ -422,7 +426,18 @@ char *mqtt5_get_publish_property_payload(uint8_t *buffer, size_t buffer_length,
ESP_LOGD(TAG, "MQTT5_PROPERTY_RESPONSE_TOPIC %.*s", resp_property->response_topic_len, resp_property->response_topic);
continue;
case MQTT5_PROPERTY_CORRELATION_DATA:
MQTT5_CONVERT_ONE_BYTE_TO_TWO(resp_property->correlation_data_len, property[property_offset ++], property[property_offset ++])
if (!mqtt5_property_has_bytes(property_offset, 2, *property_len)) {
return NULL;
}
MQTT5_CONVERT_ONE_BYTE_TO_TWO(resp_property->correlation_data_len, property[property_offset ++],
property[property_offset ++])
if (resp_property->correlation_data_len > MQTT5_MAX_PROPERTY_STRING_LEN ||
!mqtt5_property_has_bytes(property_offset, resp_property->correlation_data_len, *property_len)) {
return NULL;
}
resp_property->correlation_data = (char *)(property + property_offset);
property_offset += resp_property->correlation_data_len;
ESP_LOGD(TAG, "MQTT5_PROPERTY_CORRELATION_DATA length %d", resp_property->correlation_data_len);
@@ -438,7 +453,18 @@ char *mqtt5_get_publish_property_payload(uint8_t *buffer, size_t buffer_length,
ESP_LOGD(TAG, "MQTT5_PROPERTY_SUBSCRIBE_IDENTIFIER %d", resp_property->subscribe_id);
continue;
case MQTT5_PROPERTY_CONTENT_TYPE:
MQTT5_CONVERT_ONE_BYTE_TO_TWO(resp_property->content_type_len, property[property_offset ++], property[property_offset ++])
if (!mqtt5_property_has_bytes(property_offset, 2, *property_len)) {
return NULL;
}
MQTT5_CONVERT_ONE_BYTE_TO_TWO(resp_property->content_type_len, property[property_offset ++],
property[property_offset ++])
if (resp_property->content_type_len > MQTT5_MAX_PROPERTY_STRING_LEN ||
!mqtt5_property_has_bytes(property_offset, resp_property->content_type_len, *property_len)) {
return NULL;
}
resp_property->content_type = (char *)(property + property_offset);
property_offset += resp_property->content_type_len;
ESP_LOGD(TAG, "MQTT5_PROPERTY_CONTENT_TYPE %.*s", resp_property->content_type_len, resp_property->content_type);