abc/lwip
1
0
Fork 0
mirror of https://git.savannah.nongnu.org/git/lwip.git synced 2026-09-21 16:23:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

mqtt: fix rx_buffer overrun

Browse Source 
This has been reported multiple times, e.g. bug #68590, #68315 and #68581

Signed-off-by: Simon Goldschmidt <goldsimon@gmx.de>
This commit is contained in:
Simon Goldschmidt
2026-08-31 13:36:07 +02:00
parent f873b62959
commit 68b2c11918
2 changed files with 45 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/apps/mqtt/mqtt.c
View File

@@ -859,7 +859,11 @@ mqtt_parse_incoming(mqtt_client_t *client, struct pbuf *p)
/* parse header from this pbuf and save it in client->rx_buffer in case /* parse header from this pbuf and save it in client->rx_buffer in case
it comes in segmented */ it comes in segmented */
b = pbuf_get_at(p, in_offset++); b = pbuf_get_at(p, in_offset++);
if (client->msg_idx < MQTT_VAR_HEADER_BUFFER_LEN) {
client->rx_buffer[client->msg_idx++] = b; client->rx_buffer[client->msg_idx++] = b;
} else {
return MQTT_CONNECT_DISCONNECTED;
}
} }
fixed_hdr_len++; fixed_hdr_len++;

40
test/unit/mqtt/test_mqtt.c
View File

@@ -106,10 +106,50 @@ START_TEST(basic_connect)
} }
END_TEST END_TEST
START_TEST(rx_overflow)
{
mqtt_client_t* client;
struct netif netif;
err_t err;
struct mqtt_connect_client_info_t client_info = {
"dumm",
NULL, NULL,
10,
NULL, NULL, 0, 0, 0
};
struct pbuf* p;
unsigned char rxbuf[400];
LWIP_UNUSED_ARG(_i);
test_mqtt_init_netif(&netif, &test_mqtt_local_ip, &test_mqtt_netmask);
client = mqtt_client_new();
fail_unless(client != NULL);
err = mqtt_client_connect(client, &test_mqtt_remote_ip, 1234, test_mqtt_connection_cb, NULL, &client_info);
fail_unless(err == ERR_OK);
client->conn->connected(client->conn->callback_arg, client->conn, ERR_OK);
memset(rxbuf, sizeof(rxbuf), 0xff);
p = pbuf_alloc(PBUF_RAW, sizeof(rxbuf), PBUF_REF);
fail_unless(p != NULL);
p->payload = rxbuf;
/* since we hack the rx path, we have to hack the rx window, too: */
client->conn->rcv_wnd -= p->tot_len;
if (client->conn->recv(client->conn->callback_arg, client->conn, p, ERR_OK) != ERR_OK) {
pbuf_free(p);
}
mqtt_disconnect(client);
/* fixme: mqtt_client_fre() is missing... */
mem_free(client);
}
END_TEST
Suite* mqtt_suite(void) Suite* mqtt_suite(void)
{ {
testfunc tests[] = { testfunc tests[] = {
TESTFUNC(basic_connect), TESTFUNC(basic_connect),
TESTFUNC(rx_overflow),
}; };
return create_suite("MQTT", tests, sizeof(tests)/sizeof(testfunc), mqtt_setup, mqtt_teardown); return create_suite("MQTT", tests, sizeof(tests)/sizeof(testfunc), mqtt_setup, mqtt_teardown);
} }