espressif/esp-mqtt
1
0
Fork 1
mirror of https://github.com/espressif/esp-mqtt.git synced 2026-08-03 20:14:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(mqtt5): Fix UB in variable len processing

Browse Source
This commit is contained in:
David Cermak
2025-12-30 15:49:16 +01:00
parent b6e8c65305
commit 3c5777d706
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/mqtt5_msg.c
+10 -2
View File
@@ -61,8 +61,10 @@ static size_t get_variable_len(uint8_t *buffer, size_t offset, size_t buffer_len
*len_bytes = 0; *len_bytes = 0;
size_t len = 0, i = 0; size_t len = 0, i = 0;
for (i = offset; i < buffer_length; i ++) { // MQTT Variable Byte Integer is max 4 bytes (MQTT v5 spec).
len += (buffer[i] & 0x7f) << (7 * (i - offset)); // Limit decoding to 4 bytes to avoid undefined shift behavior on malformed inputs.
for (i = offset; i < buffer_length && (i - offset) < 4; i ++) {
len += ((size_t)(buffer[i] & 0x7f)) << (7 * (i - offset));
if ((buffer[i] & 0x80) == 0) { if ((buffer[i] & 0x80) == 0) {
i ++; i ++;
@@ -70,6 +72,12 @@ static size_t get_variable_len(uint8_t *buffer, size_t offset, size_t buffer_len
} }
} }
// If the varint didn't terminate within 4 bytes, treat as invalid (0 bytes consumed).
if ((i - offset) == 4 && i <= buffer_length && (buffer[i - 1] & 0x80)) {
*len_bytes = 0;
return 0;
}
*len_bytes = i - offset; *len_bytes = i - offset;
return len; return len;
} }