Skip to content

M
mongoose
Commit 77e44c7c authored by Deomid Ryabkov's avatar Deomid Ryabkov Committed by Cesanta Bot
Browse files
Options

Harden MQTT variable length parsing 

PUBLISHED_FROM=e16ee57bc30277e5b5684e53da78e69baaf9f779
parent abf89d32
Show whitespace changes
Inline Side-by-side
Showing with 3 additions and 2 deletions
mongoose.c
View file @ 77e44c7c
...@@ -9943,11 +9943,12 @@ MG_INTERNAL int parse_mqtt(struct mbuf *io, struct mg_mqtt_message *mm) { ...@@ -9943,11 +9943,12 @@ MG_INTERNAL int parse_mqtt(struct mbuf *io, struct mg_mqtt_message *mm) {
lc = *((const unsigned char *) p++); lc = *((const unsigned char *) p++);
len += (lc & 0x7f) << 7 * len_len; len += (lc & 0x7f) << 7 * len_len;
len_len++; len_len++;
if (!(lc & 0x80) || (len_len > sizeof(len))) break; if (!(lc & 0x80)) break;
if (len_len > 4) return -2;
} }
end = p + len; end = p + len;
if (lc & 0x80 || end > io->buf + io->len) { if (lc & 0x80 || len > (io->len - (p - io->buf))) {
return -1; return -1;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment