From bfa16b9236f44443dba7b46e834a477d380ec759 Mon Sep 17 00:00:00 2001 From: Euripedes Rocha Filho Date: Fri, 31 Jul 2026 14:09:05 +0200 Subject: [PATCH] fix(mqtt5): Prevent OOB read from mqtt 5 property --- lib/mqtt5_msg.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/lib/mqtt5_msg.c b/lib/mqtt5_msg.c index 40ed8e9..5598292 100644 --- a/lib/mqtt5_msg.c +++ b/lib/mqtt5_msg.c @@ -400,6 +400,11 @@ char *mqtt5_get_publish_property_payload(uint8_t *buffer, size_t buffer_length, *property_len = get_variable_len(buffer, offset, buffer_length, &len_bytes); offset += len_bytes; + + if (offset > buffer_length || *property_len > (buffer_length - offset)) { + return NULL; + } + uint16_t len = 0, property_offset = 0; uint8_t *property = (buffer + offset); @@ -454,8 +459,18 @@ char *mqtt5_get_publish_property_payload(uint8_t *buffer, size_t buffer_length, continue; case MQTT5_PROPERTY_CORRELATION_DATA: + if (!mqtt5_property_has_bytes(property_offset, 2, *property_len)) { + return NULL; + } + MQTT5_CONVERT_ONE_BYTE_TO_TWO(resp_property->correlation_data_len, property[property_offset ++], property[property_offset ++]) + + if (resp_property->correlation_data_len > MQTT5_MAX_PROPERTY_STRING_LEN || + !mqtt5_property_has_bytes(property_offset, resp_property->correlation_data_len, *property_len)) { + return NULL; + } + resp_property->correlation_data = (char *)(property + property_offset); property_offset += resp_property->correlation_data_len; ESP_LOGD(TAG, "MQTT5_PROPERTY_CORRELATION_DATA length %d", resp_property->correlation_data_len); @@ -473,8 +488,18 @@ char *mqtt5_get_publish_property_payload(uint8_t *buffer, size_t buffer_length, continue; case MQTT5_PROPERTY_CONTENT_TYPE: + if (!mqtt5_property_has_bytes(property_offset, 2, *property_len)) { + return NULL; + } + MQTT5_CONVERT_ONE_BYTE_TO_TWO(resp_property->content_type_len, property[property_offset ++], property[property_offset ++]) + + if (resp_property->content_type_len > MQTT5_MAX_PROPERTY_STRING_LEN || + !mqtt5_property_has_bytes(property_offset, resp_property->content_type_len, *property_len)) { + return NULL; + } + resp_property->content_type = (char *)(property + property_offset); property_offset += resp_property->content_type_len; ESP_LOGD(TAG, "MQTT5_PROPERTY_CONTENT_TYPE %.*s", resp_property->content_type_len, resp_property->content_type);