From ecaf42152efc474cfdcfbefc253e40e7626bd6c1 Mon Sep 17 00:00:00 2001
From: Tatiana Borisova <tatiana.borisova@qt.io>
Date: Thu, 27 Aug 2026 16:52:59 +0200
Subject: [PATCH] Number overflow while rejecting a too-long length

- The length reader checked its 4-byte limit after doing the maths.
So, a 5th byte was multiplied in and overflows before the value
was thrown away. But it was not noticed, because we thrown it away
and returned -1.

- The fix moves iteration++ and if (iteration > 4) before the
calculation, preventing the overflow.

Pick-to: 6.11 6.8 6.12
Task-number: QTBUG-149571
Change-Id: I78c2063c7e01af3e8f196f824216d31de92fab48
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>
---
 src/mqtt/qmqttconnection.cpp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/mqtt/qmqttconnection.cpp b/src/mqtt/qmqttconnection.cpp
index 745a7fa..acf0752 100644
--- a/src/mqtt/qmqttconnection.cpp
+++ b/src/mqtt/qmqttconnection.cpp
@@ -844,15 +844,15 @@ qint32 QMqttConnection::readVariableByteInteger(qint64 *dataSize)
     quint8 b = 0;
     quint8 iteration = 0;
     do {
-        b = readBufferTyped<quint8>(dataSize);
-        msgLength += (b & 127) * multiplier;
-        multiplier *= 128;
         iteration++;
         if (iteration > 4) {
             qCDebug(lcMqttConnection) << "Overflow trying to read variable integer.";
             closeConnection(QMqttClient::ProtocolViolation);
             return -1;
         }
+        b = readBufferTyped<quint8>(dataSize);
+        msgLength += (b & 127) * multiplier;
+        multiplier *= 128;
     } while ((b & 128) != 0);
     return msgLength;
 }