Eun0us ffd44fb424 fix: fix signed integer overflow in remaining length decoding ...

The expression (buffer[i] & 0x7f) << (7 * (i - 1)) performs a left
shift on a signed int. When i >= 5, the shift amount reaches 28+ and
0x7f << 28 overflows INT_MAX, which is undefined behavior.

Per MQTT 3.1.1 section 2.2.3, the Remaining Length field uses at most
4 continuation bytes, so limit the decoding loop accordingly. Also
cast to size_t in mqtt_get_total_length() where totlen is already
size_t.

Affects mqtt_get_total_length() and mqtt_get_publish_data().

Found via coverage-guided fuzzing (libFuzzer + UBSan).

2026-04-07 11:02:39 +02:00

..

include

chore: Adds pre-commit checks and introduce conventional commits

2025-09-26 17:45:16 +02:00

mqtt5_msg.c

Merge branch 'fix/mqtt5_var_len_ub' into 'master'

2026-02-24 13:32:42 +01:00

mqtt_msg.c

fix: fix signed integer overflow in remaining length decoding

2026-04-07 11:02:39 +02:00

mqtt_outbox.c

chore: Adds pre-commit checks and introduce conventional commits

2025-09-26 17:45:16 +02:00

platform_esp32_idf.c

chore: Adds pre-commit checks and introduce conventional commits

2025-09-26 17:45:16 +02:00