Skip to content

mqtt: return error on truncated Remaining Length#21949

Closed
bagder wants to merge 1 commit into
masterfrom
bagder/mqtt-size
Closed

mqtt: return error on truncated Remaining Length#21949
bagder wants to merge 1 commit into
masterfrom
bagder/mqtt-size

Conversation

@bagder

@bagder bagder commented Jun 10, 2026

Copy link
Copy Markdown
Member

Pointed out by: Zeropath

@bagder bagder added the MQTT label Jun 10, 2026
@bagder bagder marked this pull request as ready for review June 10, 2026 12:03
@bagder bagder requested a review from Copilot June 10, 2026 12:03

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Tightens MQTT packet parsing by rejecting truncated variable-length “Remaining Length” fields, preventing invalid/incomplete length encodings from being accepted and mis-parsed in lib/mqtt.c.

Changes:

  • Change mqtt_decode_len() to return bool (TRUE on error, FALSE on success) to match its existing call pattern.
  • Detect and reject truncated Remaining Length encodings (continuation bit still set when buffer ends).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@bagder bagder closed this in ae2986c Jun 10, 2026
@bagder bagder deleted the bagder/mqtt-size branch June 10, 2026 12:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

2 participants