Commit 332bcb39 authored by Nathaniel Wesley Filardo's avatar Nathaniel Wesley Filardo Committed by Arnim Läuger
Browse files

mqtt: fix several buffer length checks (#1906)

Partially addresses nodemcu/nodemcu-firmware#1773.
parent d777fdc5
...@@ -162,7 +162,7 @@ const char* mqtt_get_publish_topic(uint8_t* buffer, uint16_t* length) ...@@ -162,7 +162,7 @@ const char* mqtt_get_publish_topic(uint8_t* buffer, uint16_t* length)
} }
totlen += i; totlen += i;
if(i + 2 >= *length) if(i + 2 > *length)
return NULL; return NULL;
topiclen = buffer[i++] << 8; topiclen = buffer[i++] << 8;
topiclen |= buffer[i++]; topiclen |= buffer[i++];
...@@ -191,12 +191,12 @@ const char* mqtt_get_publish_data(uint8_t* buffer, uint16_t* length) ...@@ -191,12 +191,12 @@ const char* mqtt_get_publish_data(uint8_t* buffer, uint16_t* length)
} }
totlen += i; totlen += i;
if(i + 2 >= *length) if(i + 2 > *length)
return NULL; return NULL;
topiclen = buffer[i++] << 8; topiclen = buffer[i++] << 8;
topiclen |= buffer[i++]; topiclen |= buffer[i++];
if(i + topiclen >= *length){ if(i + topiclen > *length){
*length = 0; *length = 0;
return NULL; return NULL;
} }
...@@ -204,7 +204,7 @@ const char* mqtt_get_publish_data(uint8_t* buffer, uint16_t* length) ...@@ -204,7 +204,7 @@ const char* mqtt_get_publish_data(uint8_t* buffer, uint16_t* length)
if(mqtt_get_qos(buffer) > 0) if(mqtt_get_qos(buffer) > 0)
{ {
if(i + 2 >= *length) if(i + 2 > *length)
return NULL; return NULL;
i += 2; i += 2;
} }
...@@ -231,6 +231,9 @@ uint16_t mqtt_get_id(uint8_t* buffer, uint16_t length) ...@@ -231,6 +231,9 @@ uint16_t mqtt_get_id(uint8_t* buffer, uint16_t length)
int i; int i;
int topiclen; int topiclen;
if(mqtt_get_qos(buffer) <= 0)
return 0;
for(i = 1; i < length; ++i) for(i = 1; i < length; ++i)
{ {
if((buffer[i] & 0x80) == 0) if((buffer[i] & 0x80) == 0)
...@@ -240,23 +243,17 @@ uint16_t mqtt_get_id(uint8_t* buffer, uint16_t length) ...@@ -240,23 +243,17 @@ uint16_t mqtt_get_id(uint8_t* buffer, uint16_t length)
} }
} }
if(i + 2 >= length) if(i + 2 > length)
return 0; return 0;
topiclen = buffer[i++] << 8; topiclen = buffer[i++] << 8;
topiclen |= buffer[i++]; topiclen |= buffer[i++];
if(i + topiclen >= length) if(i + topiclen > length)
return 0; return 0;
i += topiclen; i += topiclen;
if(mqtt_get_qos(buffer) > 0) if(i + 2 > length)
{ return 0;
if(i + 2 >= length)
return 0;
//i += 2;
} else {
return 0;
}
return (buffer[i] << 8) | buffer[i + 1]; return (buffer[i] << 8) | buffer[i + 1];
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment