hero123457/qtmqtt
1
0
Fork 0
mirror of https://github.com/qt/qtmqtt.git synced 2026-10-25 16:16:26 +00:00
Code Issues Projects Releases Wiki Activity

Check readVariableByteInteger() return value

Browse Source 
- On error, readVariableByteInteger() closes the connection and
returns-1. In this case, message handling should stop.

- Add checks for the return value to stop processing when -1 is returned.

Pick-to: 6.11 6.8 6.12
Task-number: QTBUG-149565
Change-Id: I8f6cc8d6f3011a89d3bd4033a3432f383e1e9164
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>
This commit is contained in:
Tatiana Borisova 2026-08-27 16:59:20 +02:00
parent ecaf42152e
commit 13288574c1
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/mqtt/qmqttconnection.cpp
View File

@ -885,6 +885,8 @@ QByteArray QMqttConnection::readBuffer(quint64 size)
void QMqttConnection::readAuthProperties(QMqttAuthenticationProperties &properties)
{
qint64 propertyLength = readVariableByteInteger(&m_missingData);
if (propertyLength < 0) // Connection closed inside readVariableByteInteger
return;
m_missingData -= propertyLength;
QMqttUserProperties userProperties;
@ -926,6 +928,8 @@ void QMqttConnection::readAuthProperties(QMqttAuthenticationProperties &properti
void QMqttConnection::readConnackProperties(QMqttServerConnectionProperties &properties)
{
qint64 propertyLength = readVariableByteInteger(&m_missingData);
if (propertyLength < 0) // Connection closed inside readVariableByteInteger
return;
m_missingData -= propertyLength;
properties.serverData->valid = true;
@ -1047,6 +1051,8 @@ void QMqttConnection::readConnackProperties(QMqttServerConnectionProperties &pro
void QMqttConnection::readMessageStatusProperties(QMqttMessageStatusProperties &properties)
{
qint64 propertyLength = readVariableByteInteger(&m_missingData);
if (propertyLength < 0) // Connection closed inside readVariableByteInteger
return;
m_missingData -= propertyLength;
while (propertyLength > 0) {
@ -1073,6 +1079,8 @@ void QMqttConnection::readMessageStatusProperties(QMqttMessageStatusProperties &
void QMqttConnection::readPublishProperties(QMqttPublishProperties &properties)
{
qint64 propertyLength = readVariableByteInteger(&m_missingData);
if (propertyLength < 0) // Connection closed inside readVariableByteInteger
return;
m_missingData -= propertyLength;
QMqttUserProperties userProperties;
@ -1140,6 +1148,8 @@ void QMqttConnection::readPublishProperties(QMqttPublishProperties &properties)
void QMqttConnection::readSubscriptionProperties(QMqttSubscription *sub)
{
qint64 propertyLength = readVariableByteInteger(&m_missingData);
if (propertyLength < 0) // Connection closed inside readVariableByteInteger
return;
m_missingData -= propertyLength;
while (propertyLength > 0) {
@ -1970,6 +1980,8 @@ bool QMqttConnection::processDataHelper()
}
qint32 payloadSize = readVariableByteInteger();
if (payloadSize < 0) // Connection closed inside readVariableByteInteger
return false;
if (m_clientPrivate->m_protocolVersion != QMqttClient::MQTT_5_0) {
if (payloadSize != 2) {
qCDebug(lcMqttConnection) << "Unexpected FRAME size in CONNACK.";