RepoMirrors/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git/ synced 2025-01-24 06:22:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MINOR: mqtt: Fix parser for string with more than 127 characters

Browse Source 
Parsing of too long strings (> 127 characters) was buggy because of a wrong
cast on the length bytes. To fix the bug, we rely on mqtt_read_2byte_int()
function. This way, the string length is properly decoded.

This patch should partely fix the issue #1310. It must be backported to 2.4.
This commit is contained in:
Christopher Faulet 2021-06-28 15:26:00 +02:00
parent 5bbfff107b
commit ca925c9c28
2 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
reg-tests/converter/mqtt.vtc
View File

@ -4,8 +4,8 @@ varnishtest "mqtt converters Test"
feature ignore_unknown_macro
server s1 {
# MQTT 3.1.1 CONNECT packet (id: test_sub)
recv 22
# MQTT 3.1.1 CONNECT packet (id: test_subaaaaaa... [len = 200])
recv 215
sendhex "20020000"
close
@ -114,7 +114,7 @@ haproxy h1 -conf {
client c1_311_1 -connect ${h1_fe1_sock} {
# Valid MQTT 3.1.1 CONNECT packet (id: test_sub)
sendhex "101400044d5154540402003c0008746573745f737562"
sendhex "10d40100044d5154540402003c00c8746573745f737562616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161616161"
recv 4
expect_close
} -run

7
src/mqtt.c
View File

@ -288,15 +288,14 @@ static inline struct ist mqtt_read_varint(struct ist parser, uint32_t *i)
*/
static inline struct ist mqtt_read_string(struct ist parser, struct ist *str)
{
uint16_t len;
uint16_t len = 0;
/* read and compute the string length */
if (istlen(parser) <= 2)
goto error;
len = ((uint16_t)*istptr(parser) << 8) + (uint16_t)*(istptr(parser) + 1);
parser = istadv(parser, 2);
if (istlen(parser) < len)
parser = mqtt_read_2byte_int(parser, &len);
if (!isttest(parser) || istlen(parser) < len)
goto error;
if (str) {