hero123457/qtmqtt
1
0
Fork 0
mirror of https://github.com/qt/qtmqtt.git synced 2026-10-25 16:16:26 +00:00
Code Issues Projects Releases Wiki Activity

Number overflow while rejecting a too-long length

Browse Source 
- The length reader checked its 4-byte limit after doing the maths.
So, a 5th byte was multiplied in and overflows before the value
was thrown away. But it was not noticed, because we thrown it away
and returned -1.

- The fix moves iteration++ and if (iteration > 4) before the
calculation, preventing the overflow.

Pick-to: 6.11 6.8 6.12
Task-number: QTBUG-149571
Change-Id: I78c2063c7e01af3e8f196f824216d31de92fab48
Reviewed-by: Ivan Solovev <ivan.solovev@qt.io>
This commit is contained in:
Tatiana Borisova 2026-08-27 16:52:59 +02:00
parent ba2b82223a
commit ecaf42152e
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/mqtt/qmqttconnection.cpp
View File

@ -844,15 +844,15 @@ qint32 QMqttConnection::readVariableByteInteger(qint64 *dataSize)
quint8 b = 0; quint8 b = 0;
quint8 iteration = 0; quint8 iteration = 0;
do { do {
b = readBufferTyped<quint8>(dataSize);
msgLength += (b & 127) * multiplier;
multiplier *= 128;
iteration++; iteration++;
if (iteration > 4) { if (iteration > 4) {
qCDebug(lcMqttConnection) << "Overflow trying to read variable integer."; qCDebug(lcMqttConnection) << "Overflow trying to read variable integer.";
closeConnection(QMqttClient::ProtocolViolation); closeConnection(QMqttClient::ProtocolViolation);
return -1; return -1;
} }
b = readBufferTyped<quint8>(dataSize);
msgLength += (b & 127) * multiplier;
multiplier *= 128;
} while ((b & 128) != 0); } while ((b & 128) != 0);
return msgLength; return msgLength;
} }