From 32c6b58ab9d21e5f9a13244bb74832ae6ccca129 Mon Sep 17 00:00:00 2001 From: chenzhenhua5 Date: Mon, 8 Aug 2022 20:57:08 +0800 Subject: [PATCH 1/2] Fix array out of bound issue when receive invalid suback packet. WHAT: when call MQTTClient_subscribe interface to subscribe topics, the SUBSCRIBE packet would be sent to broker, the according SUBACK packet would be returned, if the SUBACK packet returncodes amount is not consist with the SUBSCRIBE packet topic amount, the array out of bound issue could hanppend. WHY: In MQTTClient_subscribeMany5 function, after internal MQTTClient_waitfor function called, the SUBACK packet is received, traverse the qoss list to get the qos, the qos info would be stored in the current function param array "qos", but the array bound is not check when accessing, therefore, the out-of-bound issue would taken place. How: check the size of array "qos" to avoid out-of-bound issue Reviewed by: caojianlong Test by: shilei Signed-off-by: chenzhenhua5 --- src/MQTTClient.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/MQTTClient.c b/src/MQTTClient.c index e3c58b24..ec7c8d02 100644 --- a/src/MQTTClient.c +++ b/src/MQTTClient.c @@ -2079,6 +2079,11 @@ MQTTResponse MQTTClient_subscribeMany5(MQTTClient handle, int count, char* const } else { + if (count < sub->qoss->count) + { + rc = MQTTCLIENT_FAILURE; + goto exit; + } ListElement* current = NULL; i = 0; while (ListNextElement(sub->qoss, ¤t)) From 951a263dcd824efac116bf0369495c4bf736c191 Mon Sep 17 00:00:00 2001 From: Ian Craggs Date: Wed, 28 Sep 2022 14:19:29 +0100 Subject: [PATCH 2/2] Fix up suback count check --- src/MQTTClient.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/src/MQTTClient.c b/src/MQTTClient.c index c3effdc4..8f156b08 100644 --- a/src/MQTTClient.c +++ b/src/MQTTClient.c @@ -2080,17 +2080,19 @@ MQTTResponse MQTTClient_subscribeMany5(MQTTClient handle, int count, char* const } else { - if (count < sub->qoss->count) - { + ListElement *current = NULL; + + /* if the returned count is greater than requested, it's an error*/ + if (sub->qoss->count > count) rc = MQTTCLIENT_FAILURE; - goto exit; - } - ListElement* current = NULL; - i = 0; - while (ListNextElement(sub->qoss, ¤t)) + else { - int* reqqos = (int*)(current->content); - qos[i++] = *reqqos; + i = 0; + while (ListNextElement(sub->qoss, ¤t)) + { + int *reqqos = (int*) (current->content); + qos[i++] = *reqqos; + } } resp.reasonCode = rc; }