Number overflow while rejecting a too-long length

- The length reader checked its 4-byte limit after doing the maths.
So, a 5th byte was multiplied in and overflows before the value
was thrown away. But it was not noticed, because we thrown it away
and returned -1.

- The fix moves iteration++ and if (iteration > 4) before the
calculation, preventing the overflow.

Pick-to: 6.11 6.8 6.12
Task-number: QTBUG-149571
Change-Id: I78c2063c7e01af3e8f196f824216d31de92fab48
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>

src/mqtt/qmqttconnection.cpp

@@ -844,15 +844,15 @@ qint32 QMqttConnection::readVariableByteInteger(qint64 *dataSize)
     quint8 b = 0;
     quint8 iteration = 0;
     do {
-        b = readBufferTyped<quint8>(dataSize);
-        msgLength += (b & 127) * multiplier;
-        multiplier *= 128;
         iteration++;
         if (iteration > 4) {
             qCDebug(lcMqttConnection) << "Overflow trying to read variable integer.";
             closeConnection(QMqttClient::ProtocolViolation);
             return -1;
         }
+        b = readBufferTyped<quint8>(dataSize);
+        msgLength += (b & 127) * multiplier;
+        multiplier *= 128;
     } while ((b & 128) != 0);
     return msgLength;
 }