From 2260f5a5e0d8a6477f0ee7f998888f79216419c0 Mon Sep 17 00:00:00 2001
From: Ian Craggs <icraggs@gmail.com>
Date: Mon, 13 Jul 2026 12:50:34 +0100
Subject: [PATCH] Check that the properties length isn't longer than the
 remaining packet data

---
 src/MQTTProperties.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/MQTTProperties.c b/src/MQTTProperties.c
index ee07b277..987875f6 100644
--- a/src/MQTTProperties.c
+++ b/src/MQTTProperties.c
@@ -346,13 +346,14 @@ int MQTTProperties_read(MQTTProperties *properties, char **pptr, char *enddata)
     int proplen = 0;
 
     rc = MQTTPacket_decodeBuf(*pptr, enddata, (unsigned int*)&remlength);
-    if (rc > 0)
-      *pptr += rc;
-    else
+    if (rc <= 0 || !is_enough_data(pptr, enddata, remlength))
     {
       rc = MQTTPACKET_BUFFER_TOO_SHORT;
       goto exit;
     }
+    else
+      *pptr += rc;
+
     properties->length = remlength;
     while (remlength > 0)
     {