From 32c6b58ab9d21e5f9a13244bb74832ae6ccca129 Mon Sep 17 00:00:00 2001 From: chenzhenhua5 Date: Mon, 8 Aug 2022 20:57:08 +0800 Subject: [PATCH] Fix array out of bound issue when receive invalid suback packet. WHAT: when call MQTTClient_subscribe interface to subscribe topics, the SUBSCRIBE packet would be sent to broker, the according SUBACK packet would be returned, if the SUBACK packet returncodes amount is not consist with the SUBSCRIBE packet topic amount, the array out of bound issue could hanppend. WHY: In MQTTClient_subscribeMany5 function, after internal MQTTClient_waitfor function called, the SUBACK packet is received, traverse the qoss list to get the qos, the qos info would be stored in the current function param array "qos", but the array bound is not check when accessing, therefore, the out-of-bound issue would taken place. How: check the size of array "qos" to avoid out-of-bound issue Reviewed by: caojianlong Test by: shilei Signed-off-by: chenzhenhua5 --- src/MQTTClient.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/MQTTClient.c b/src/MQTTClient.c index e3c58b24..ec7c8d02 100644 --- a/src/MQTTClient.c +++ b/src/MQTTClient.c @@ -2079,6 +2079,11 @@ MQTTResponse MQTTClient_subscribeMany5(MQTTClient handle, int count, char* const } else { + if (count < sub->qoss->count) + { + rc = MQTTCLIENT_FAILURE; + goto exit; + } ListElement* current = NULL; i = 0; while (ListNextElement(sub->qoss, ¤t))