From 21b866609f8f9e292fc5284dc4e7b91627c01f4d Mon Sep 17 00:00:00 2001
From: Tatiana Borisova <tatiana.borisova@qt.io>
Date: Thu, 27 Aug 2026 12:56:34 +0200
Subject: [PATCH] The Qt app can freeze forever if the broker sends a bad
 message

- When QMqttConnection reads a message, it keeps a count of the bytes
left to read -> by the dataSize argument. If a read fails, the count
is never reduced.
- The fix cleaning up the count of the bytes left to read, since
the reading is not working anymore and parsing should be stopped.
It allows to get read of potential freezes.

The patch also updates the QByteArray specialization to return a
default-constructed QBA in case of an error. This is more in line
with the default implementation.

Pick-to: 6.11 6.12 6.8
Task-number: QTBUG-149563
Change-Id: I8c8c5ef354103a996ac6e360fbc5c8f61d965f3d
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>
---
 src/mqtt/qmqttconnection.cpp | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/src/mqtt/qmqttconnection.cpp b/src/mqtt/qmqttconnection.cpp
index 6c86e96..5e3fb6b 100644
--- a/src/mqtt/qmqttconnection.cpp
+++ b/src/mqtt/qmqttconnection.cpp
@@ -32,10 +32,16 @@ T QMqttConnection::readBufferTyped(qint64 *dataSize)
     T result = 0;
     if (Q_UNLIKELY(dataSize != nullptr && *dataSize < qint64(sizeof(result)))) {
         qCWarning(lcMqttConnection) << "Attempt to read past the data";
+        *dataSize = 0;
         return result;
     }
-    if (readBuffer(reinterpret_cast<char *>(&result), sizeof(result)) && dataSize != nullptr)
-        *dataSize -= sizeof(result);
+    const bool isOk = readBuffer(reinterpret_cast<char *>(&result), sizeof(result));
+    if (dataSize != nullptr) {
+        if (isOk)
+            *dataSize -= sizeof(result);
+        else
+            *dataSize = 0;
+    }
     return qFromBigEndian(result);
 }
 
@@ -45,10 +51,17 @@ QByteArray QMqttConnection::readBufferTyped(qint64 *dataSize)
     const quint16 size = readBufferTyped<quint16>(dataSize);
     if (Q_UNLIKELY(dataSize != nullptr && *dataSize < qint64(size))) {
         qCWarning(lcMqttConnection) << "Attempt to read past the data";
+        *dataSize = 0;
         return QByteArray();
     }
     QByteArray ba(int(size), Qt::Uninitialized);
-    if (readBuffer(ba.data(), size) && dataSize != nullptr)
+    const bool isOk = readBuffer(ba.data(), size);
+    if (!isOk) {
+        if (dataSize != nullptr)
+            *dataSize = 0;
+        return QByteArray();
+    }
+    if (dataSize != nullptr)
         *dataSize -= size;
     return ba;
 }