Harden MQTT variable length parsing

PUBLISHED_FROM=e16ee57bc30277e5b5684e53da78e69baaf9f779

Harden MQTT variable length parsing
PUBLISHED_FROM=e16ee57bc30277e5b5684e53da78e69baaf9f779
77e44c7c · Deomid Ryabkov · Cesanta Bot · abf89d32 · 77e44c7c
Commit 77e44c7c authored Sep 06, 2017 by Deomid Ryabkov Committed by Cesanta Bot Sep 06, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 2 deletions

mongoose.c mongoose.c +3 -2

No files found.
--- a/mongoose.c
+++ b/mongoose.c
@@ -9943,11 +9943,12 @@ MG_INTERNAL int parse_mqtt(struct mbuf *io, struct mg_mqtt_message *mm) {
    lc = *((const unsigned char *) p++);
    len += (lc & 0x7f) << 7 * len_len;
    len_len++;
-    if (!(lc & 0x80) || (len_len > sizeof(len))) break;
+    if (!(lc & 0x80)) break;
+    if (len_len > 4) return -2;
  }

  end = p + len;
-  if (lc & 0x80 || end > io->buf + io->len) {
+  if (lc & 0x80 || len > (io->len - (p - io->buf))) {
    return -1;
  }