romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-06-25 18:45:38 +03:00
Code Issues Projects Releases Packages Wiki Activity

mqtt: return error on truncated Remaining Length

Browse source 
Pointed out by: Zeropath

Closes #21949
This commit is contained in:
Daniel Stenberg 2026-06-10 13:52:13 +02:00
parent a6cece52e4
commit ae2986cdf0
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
1 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
lib/mqtt.c
View file

@ -602,9 +602,9 @@ fail:
return result;
}
/* return 0 on success, non-zero on error */
static int mqtt_decode_len(size_t *lenp, const unsigned char *buf,
size_t buflen)
/* return FALSE on success, TRUE on error */
static bool mqtt_decode_len(size_t *lenp, const unsigned char *buf,
size_t buflen)
{
size_t len = 0;
size_t mult = 1;
@ -613,14 +613,17 @@ static int mqtt_decode_len(size_t *lenp, const unsigned char *buf,
for(i = 0; (i < buflen) && (encoded & 128); i++) {
if(i == 4)
return 1; /* bad size */
return TRUE; /* bad size */
encoded = buf[i];
len += (encoded & 127) * mult;
mult *= 128;
}
if(encoded & 128)
/* truncated size */
return TRUE;
*lenp = len;
return 0;
return FALSE;
}
#if defined(DEBUGBUILD) && defined(CURLVERBOSE)