Fix OOB in payload format #1644

This commit is contained in:
Ian Craggs 2026-02-14 16:04:23 +00:00
parent 3a2c6184d7
commit f1cafef41a
No known key found for this signature in database
GPG Key ID: A7AE1A8F2CCAB186
1 changed files with 3 additions and 2 deletions

View File

@ -869,13 +869,14 @@ int MQTTPacket_formatPayload(int buflen, char* buf, int payloadlen, char* payloa
else
{
static char *hexdigit = "0123456789ABCDEF";
unsigned char curchar = (unsigned char)payload[i];
if (pos >= buflen - 3)
break;
buf[pos++] = '\\';
buf[pos++] = 'x';
buf[pos++] = hexdigit[payload[i] & 0xF0];
buf[pos++] = hexdigit[payload[i] & 0x0F];
buf[pos++] = hexdigit[(curchar & 0xF0) >> 4];
buf[pos++] = hexdigit[curchar & 0x0F];
}
}