Fix memory leak when clients send v5 CONNECT packets.

This occurs when they have a will message that contains invalid property types.
eclipse · Aug 16, 2023 · 00b24e0 · 00b24e0 · apoleon · Sep 22, 2023
1 parent 4f9002c
commit 00b24e0
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/ChangeLog.txt b/ChangeLog.txt
@@ -2,6 +2,8 @@ Security:
 - CVE-2023-28366: Fix memory leak in broker when clients send multiple QoS 2
   messages with the same message ID, but then never respond to the PUBREC
   commands.
+- CVE-xxxx-xxxxx: Fix memory leak when clients send v5 CONNECT packets with a
+  will message that contains invalid property types.
 - Broker will now reject Will messages that attempt to publish to $CONTROL/.
 - Broker now validates usernames provided in a TLS certificate or TLS-PSK
   identity are valid UTF-8.

diff --git a/src/property_broker.c b/src/property_broker.c
@@ -103,6 +103,7 @@ int property__process_will(struct mosquitto *context, struct mosquitto_message_a
 				break;
 
 			default:
+				msg->properties = msg_properties;
 				return MOSQ_ERR_PROTOCOL;
 				break;
 		}