j3d1/esp-open-rtos
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Fixed a buffer overflow issue when receiving large MQTT packet.

Browse source
This commit is contained in:
Rong Shen 2016-07-28 14:38:03 -07:00
parent 40fcc84c6d
commit 16b53e11e2
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
extras/paho_mqtt_c/MQTTClient.c
View file

@ -94,8 +94,13 @@ int readPacket(MQTTClient* c, Timer* timer)
goto exit; goto exit;
len = 1; len = 1;
/* 2. read the remaining length. This is variable in itself */ /* 2. read the remaining length. This is variable in itself */
decodePacket(c, &rem_len, left_ms(timer)); len += decodePacket(c, &rem_len, left_ms(timer));
len += MQTTPacket_encode(c->readbuf + 1, rem_len); /* put the original remaining length back into the buffer */ if (len <= 1 || len + rem_len > c->readbuf_size) /* if packet is too big to fit in our readbuf, abort */
{
rc = READ_ERROR;
goto exit;
}
MQTTPacket_encode(c->readbuf + 1, rem_len); /* put the original remaining length back into the buffer */
/* 3. read the rest of the buffer using a callback to supply the rest of the data */ /* 3. read the rest of the buffer using a callback to supply the rest of the data */
if (rem_len > 0 && (c->ipstack->mqttread(c->ipstack, c->readbuf + len, rem_len, left_ms(timer)) != rem_len)) if (rem_len > 0 && (c->ipstack->mqttread(c->ipstack, c->readbuf + len, rem_len, left_ms(timer)) != rem_len))
{ {