From bcfe1d5958ad9f4a69fff176e029a454fb84a8b4 Mon Sep 17 00:00:00 2001
From: Euripedes Rocha Filho <rocha.euripedes@espressif.com>
Date: Fri, 31 Jul 2026 14:09:05 +0200
Subject: [PATCH] fix(mqtt5): Prevent OOB read from mqtt 5 property

---
 lib/mqtt5_msg.c | 30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/lib/mqtt5_msg.c b/lib/mqtt5_msg.c
index 5dcf4bc..64d0fe9 100644
--- a/lib/mqtt5_msg.c
+++ b/lib/mqtt5_msg.c
@@ -374,6 +374,10 @@ char *mqtt5_get_publish_property_payload(uint8_t *buffer, size_t buffer_length,
     *property_len = get_variable_len(buffer, offset, buffer_length, &len_bytes);
     offset += len_bytes;
 
+    if (offset > buffer_length || *property_len > (buffer_length - offset)) {
+        return NULL;
+    }
+
     uint16_t len = 0, property_offset = 0;
     uint8_t *property = (buffer + offset);
     while (property_offset < *property_len) {
@@ -422,7 +426,18 @@ char *mqtt5_get_publish_property_payload(uint8_t *buffer, size_t buffer_length,
             ESP_LOGD(TAG, "MQTT5_PROPERTY_RESPONSE_TOPIC %.*s", resp_property->response_topic_len, resp_property->response_topic);
             continue;
         case MQTT5_PROPERTY_CORRELATION_DATA:
-            MQTT5_CONVERT_ONE_BYTE_TO_TWO(resp_property->correlation_data_len, property[property_offset ++], property[property_offset ++])
+            if (!mqtt5_property_has_bytes(property_offset, 2, *property_len)) {
+                return NULL;
+            }
+
+            MQTT5_CONVERT_ONE_BYTE_TO_TWO(resp_property->correlation_data_len, property[property_offset ++],
+                                          property[property_offset ++])
+
+            if (resp_property->correlation_data_len > MQTT5_MAX_PROPERTY_STRING_LEN ||
+                    !mqtt5_property_has_bytes(property_offset, resp_property->correlation_data_len, *property_len)) {
+                return NULL;
+            }
+
             resp_property->correlation_data = (char *)(property + property_offset);
             property_offset += resp_property->correlation_data_len;
             ESP_LOGD(TAG, "MQTT5_PROPERTY_CORRELATION_DATA length %d", resp_property->correlation_data_len);
@@ -438,7 +453,18 @@ char *mqtt5_get_publish_property_payload(uint8_t *buffer, size_t buffer_length,
             ESP_LOGD(TAG, "MQTT5_PROPERTY_SUBSCRIBE_IDENTIFIER %d", resp_property->subscribe_id);
             continue;
         case MQTT5_PROPERTY_CONTENT_TYPE:
-            MQTT5_CONVERT_ONE_BYTE_TO_TWO(resp_property->content_type_len, property[property_offset ++], property[property_offset ++])
+            if (!mqtt5_property_has_bytes(property_offset, 2, *property_len)) {
+                return NULL;
+            }
+
+            MQTT5_CONVERT_ONE_BYTE_TO_TWO(resp_property->content_type_len, property[property_offset ++],
+                                          property[property_offset ++])
+
+            if (resp_property->content_type_len > MQTT5_MAX_PROPERTY_STRING_LEN ||
+                    !mqtt5_property_has_bytes(property_offset, resp_property->content_type_len, *property_len)) {
+                return NULL;
+            }
+
             resp_property->content_type = (char *)(property + property_offset);
             property_offset += resp_property->content_type_len;
             ESP_LOGD(TAG, "MQTT5_PROPERTY_CONTENT_TYPE  %.*s", resp_property->content_type_len, resp_property->content_type);