C client's readPacket can overflow read buffer

[cpacey]

The C client's readPacket reads the message size from the incoming packet and then reads that much data into the read buffer (c->readbuf) with no regard for the read buffer's size (c->readbuf_size). This means that messages larger than the read buffer's size will always cause a buffer overflow.

We're using FreeRTOS, with a read buffer that's allocated on the stack of the task that's handling Mqtt. When this buffer overflow occurs it smashes our stack (including the MQTTClient) and leads to anomalous behaviour.

[andrewchambers]

Yes, this library seems to have many buffer overflows and other similar issues, I would not recommend using it when you don't trust your endpoint.

[eden-wang]

I found the problem too. When read buffer is not enough, I disgard the rest data. Here is the main codes

/* erase useless data */
read_bytes = 0;
while (read_bytes < rem_len || expired(timer))
{
    read_bytes += c->ipstack->mqttread(c->ipstack,
            c->readbuf,
            min(c->readbuf_size, rem_len - read_bytes),
            left_ms(timer));
}

[icraggs]

I've added a fix for this in readPacket which I believe does most of the job. If the read buffer is very small (less than the header + length of remaining length, between 0 and 5) then that could still be a problem, but buffers of that size are not very useful anyway.

[AkremToujani]

Hi Teams,
I'm using paho mqtt client with NUCLEO STM32 board,
I fixed the KeepAlive Interval to 30 min (1800s) and yield(100), but, after 9 hours the client has disconnected.

any help please
thanks a lot