mirror/mongoose
1
0
Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2025-07-23 21:56:16 +08:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

Fix fuzzer use-after-poison READ 1

Browse Source
This commit is contained in:
cpq 2022-11-11 15:03:48 +00:00
parent cab5c822c5
commit a39b7ddbac
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
mongoose.c
View File

@ -3196,7 +3196,7 @@ int mg_mqtt_parse(const uint8_t *buf, size_t len, uint8_t version,
p += 2; p += 2;
} }
if (p > end) return MQTT_MALFORMED; if (p > end) return MQTT_MALFORMED;
if (version == 5 && p + 1 < end) p += 1 + p[0]; // Skip options if (version == 5 && p + 2 < end) p += 1 + p[0]; // Skip options
if (p > end) return MQTT_MALFORMED; if (p > end) return MQTT_MALFORMED;
m->data.ptr = (char *) p; m->data.ptr = (char *) p;
m->data.len = (size_t) (end - p); m->data.len = (size_t) (end - p);

2
src/mqtt.c
View File

@ -173,7 +173,7 @@ int mg_mqtt_parse(const uint8_t *buf, size_t len, uint8_t version,
p += 2; p += 2;
} }
if (p > end) return MQTT_MALFORMED; if (p > end) return MQTT_MALFORMED;
if (version == 5 && p + 1 < end) p += 1 + p[0]; // Skip options if (version == 5 && p + 2 < end) p += 1 + p[0]; // Skip options
if (p > end) return MQTT_MALFORMED; if (p > end) return MQTT_MALFORMED;
m->data.ptr = (char *) p; m->data.ptr = (char *) p;
m->data.len = (size_t) (end - p); m->data.len = (size_t) (end - p);