Skip to content

Fix use-after-free and memory leak in mqtt_pit.c #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
juandiego-bmu wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Fix use-after-free and memory leak in mqtt_pit.c #20

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c8e0c04
Fix use-after-free in packet loop and memory leak in sendPubrel
juandiego-bmu Mar 28, 2026
b08626a
Add NULL check after lookupClient() to prevent NULL pointer dereference
juandiego-bmu Mar 28, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 21 additions & 5 deletions servers/mqtt_pit.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -622,10 +622,12 @@ bool sendPubrel(struct mqttClient* client, uint16_t packetId) {
ssize_t w = write(client->fd, arr, size);
if (w == -1) {
fprintf(stderr, "sendPubrel: write failed");
free(arr);
return false;
}

// syslog(LOG_INFO, "Sent PUBREL to client fd=%d", client->fd);
free(arr);
return true;
}

Expand Down Expand Up @@ -869,6 +871,11 @@ int main(int argc, char* argv[]) {
// }
} else {
struct mqttClient* client = lookupClient(currentFd);
if (client == NULL) {
epoll_ctl(epollfd, EPOLL_CTL_DEL, currentFd, NULL);
close(currentFd);
continue;
}
ssize_t bytesRead = read(currentFd,
client->buffer + client->bytesWrittenToBuffer, // Avoid overwriting existing data
sizeof(client->buffer) - client->bytesWrittenToBuffer);
Expand Down Expand Up @@ -898,11 +905,12 @@ int main(int argc, char* argv[]) {
packetLengths, packetStarts, &packetCount);

uint32_t processedPackets = 0;
bool clientDisconnected = false;
for (uint32_t i = 0; i < packetCount; i++) {
uint32_t packetLength = packetLengths[i];
uint32_t packetStart = packetStarts[i];
uint32_t packetEnd = packetStart + packetLength;

if (packetLength == 0 || processedPackets + packetLength > client->bytesWrittenToBuffer) {
// syslog(LOG_INFO, "Incomplete packet");
break; // Incomplete packet
Expand All @@ -924,12 +932,14 @@ int main(int argc, char* argv[]) {
if(!ackSuccess) {
fprintf(stderr, "Disconnecting client due to CONNACK failure");
disconnectClient(client, epollfd, now);
clientDisconnected = true;
break;
}
pubSuccess = sendPublish(client, "$SYS/credentials", "username=admin password=admin");
if(!pubSuccess) {
fprintf(stderr, "Disconnecting client due to publish failure");
disconnectClient(client, epollfd, now);
clientDisconnected = true;
}
break;
case SUBSCRIBE:
Expand All @@ -947,6 +957,7 @@ int main(int argc, char* argv[]) {
if(!pubSuccess) {
fprintf(stderr, "Disconnecting client due to publish failure");
disconnectClient(client, epollfd, now);
clientDisconnected = true;
}
break;
case UNSUBSCRIBE:
Expand All @@ -957,23 +968,28 @@ int main(int argc, char* argv[]) {
if(!pingSuccess){
fprintf(stderr, "Disconnecting client due to ping failure");
disconnectClient(client, epollfd, now);
clientDisconnected = true;
break;
}
break;
case DISCONNECT:
fprintf(stderr, "Disconnecting client due to receiving DISCONNECT");
disconnectClient(client, epollfd, now);
clientDisconnected = true;
break;
default:
break;
}
if (clientDisconnected) break;
processedPackets += packetLength;
}
uint32_t leftover = client->bytesWrittenToBuffer - processedPackets;
if (leftover > 0) {
memmove(client->buffer, client->buffer + processedPackets, leftover);
if (!clientDisconnected) {
uint32_t leftover = client->bytesWrittenToBuffer - processedPackets;
if (leftover > 0) {
memmove(client->buffer, client->buffer + processedPackets, leftover);
}
client->bytesWrittenToBuffer = leftover;
}
client->bytesWrittenToBuffer = leftover;
}

}
Expand Down