romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-24 15:57:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

mqtt: handle POST/PUBLISH without a set POSTFIELDSIZE

Browse source 
Detected by OSS-Fuzz
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28735

Added test 1916 and 1917 to verify.

Closes #6338
This commit is contained in:
Daniel Stenberg 2020-12-17 13:34:38 +01:00
parent 92fe66c510
commit debf23eead
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
8 changed files with 191 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/mqtt.c
View file

@ -319,7 +319,7 @@ static CURLcode mqtt_publish(struct connectdata *conn)
{
CURLcode result;
char *payload = conn->data->set.postfields;
size_t payloadlen = (size_t)conn->data->set.postfieldsize;
size_t payloadlen;
char *topic = NULL;
size_t topiclen;
unsigned char *pkt = NULL;
@ -327,6 +327,14 @@ static CURLcode mqtt_publish(struct connectdata *conn)
size_t remaininglength;
size_t encodelen;
char encodedbytes[4];
curl_off_t postfieldsize = conn->data->set.postfieldsize;
if(!payload)
return CURLE_BAD_FUNCTION_ARGUMENT;
if(postfieldsize < 0)
payloadlen = strlen(payload);
else
payloadlen = (size_t)postfieldsize;
result = mqtt_get_topic(conn, &topic, &topiclen);
if(result)