espressif/esp-mqtt
1
0
Fork 0
mirror of https://github.com/espressif/esp-mqtt.git synced 2026-09-30 21:07:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(mqtt5): Prevent OOB read from mqtt 5 property

Browse Source
This commit is contained in:
Euripedes Rocha Filho
2026-07-31 14:09:05 +02:00
parent 5a9ba05aa3
commit bfa16b9236
1 changed files with 25 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/mqtt5_msg.c
+25
View File
@@ -400,6 +400,11 @@ char *mqtt5_get_publish_property_payload(uint8_t *buffer, size_t buffer_length,
*property_len = get_variable_len(buffer, offset, buffer_length, &len_bytes);
offset += len_bytes;
if (offset > buffer_length || *property_len > (buffer_length - offset)) {
return NULL;
}
uint16_t len = 0, property_offset = 0;
uint8_t *property = (buffer + offset);
@@ -454,8 +459,18 @@ char *mqtt5_get_publish_property_payload(uint8_t *buffer, size_t buffer_length,
continue;
case MQTT5_PROPERTY_CORRELATION_DATA:
if (!mqtt5_property_has_bytes(property_offset, 2, *property_len)) {
return NULL;
}
MQTT5_CONVERT_ONE_BYTE_TO_TWO(resp_property->correlation_data_len, property[property_offset ++],
property[property_offset ++])
if (resp_property->correlation_data_len > MQTT5_MAX_PROPERTY_STRING_LEN ||
!mqtt5_property_has_bytes(property_offset, resp_property->correlation_data_len, *property_len)) {
return NULL;
}
resp_property->correlation_data = (char *)(property + property_offset);
property_offset += resp_property->correlation_data_len;
ESP_LOGD(TAG, "MQTT5_PROPERTY_CORRELATION_DATA length %d", resp_property->correlation_data_len);
@@ -473,8 +488,18 @@ char *mqtt5_get_publish_property_payload(uint8_t *buffer, size_t buffer_length,
continue;
case MQTT5_PROPERTY_CONTENT_TYPE:
if (!mqtt5_property_has_bytes(property_offset, 2, *property_len)) {
return NULL;
}
MQTT5_CONVERT_ONE_BYTE_TO_TWO(resp_property->content_type_len, property[property_offset ++],
property[property_offset ++])
if (resp_property->content_type_len > MQTT5_MAX_PROPERTY_STRING_LEN ||
!mqtt5_property_has_bytes(property_offset, resp_property->content_type_len, *property_len)) {
return NULL;
}
resp_property->content_type = (char *)(property + property_offset);
property_offset += resp_property->content_type_len;
ESP_LOGD(TAG, "MQTT5_PROPERTY_CONTENT_TYPE %.*s", resp_property->content_type_len, resp_property->content_type);