Skip to content

fix: prevent UAF in MQTT packet processing loop #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
goyalpalak18 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: prevent UAF in MQTT packet processing loop #5

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions servers/mqtt_pit.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -898,11 +898,12 @@ int main(int argc, char* argv[]) {
packetLengths, packetStarts, &packetCount);

uint32_t processedPackets = 0;
bool clientFreed = false;
for (uint32_t i = 0; i < packetCount; i++) {
uint32_t packetLength = packetLengths[i];
uint32_t packetStart = packetStarts[i];
uint32_t packetEnd = packetStart + packetLength;

if (packetLength == 0 || processedPackets + packetLength > client->bytesWrittenToBuffer) {
// syslog(LOG_INFO, "Incomplete packet");
break; // Incomplete packet
Expand All @@ -923,12 +924,14 @@ int main(int argc, char* argv[]) {
bool ackSuccess = sendConnack(client, reasonCodeConn);
if(!ackSuccess) {
fprintf(stderr, "Disconnecting client due to CONNACK failure");
clientFreed = true;
disconnectClient(client, epollfd, now);
break;
}
pubSuccess = sendPublish(client, "$SYS/credentials", "username=admin password=admin");
if(!pubSuccess) {
fprintf(stderr, "Disconnecting client due to publish failure");
clientFreed = true;
disconnectClient(client, epollfd, now);
}
break;
Expand All @@ -946,6 +949,7 @@ int main(int argc, char* argv[]) {
pubSuccess = sendPublish(client, "$SYS/confidential", "username=admin123 password=admin321");
if(!pubSuccess) {
fprintf(stderr, "Disconnecting client due to publish failure");
clientFreed = true;
disconnectClient(client, epollfd, now);
}
break;
Expand All @@ -956,24 +960,29 @@ int main(int argc, char* argv[]) {
bool pingSuccess = sendPingresp(client);
if(!pingSuccess){
fprintf(stderr, "Disconnecting client due to ping failure");
clientFreed = true;
disconnectClient(client, epollfd, now);
break;
}
break;
case DISCONNECT:
fprintf(stderr, "Disconnecting client due to receiving DISCONNECT");
clientFreed = true;
disconnectClient(client, epollfd, now);
break;
default:
break;
}
processedPackets += packetLength;
if (clientFreed) break;
}
uint32_t leftover = client->bytesWrittenToBuffer - processedPackets;
if (leftover > 0) {
memmove(client->buffer, client->buffer + processedPackets, leftover);
if (!clientFreed) {
uint32_t leftover = client->bytesWrittenToBuffer - processedPackets;
if (leftover > 0) {
memmove(client->buffer, client->buffer + processedPackets, leftover);
}
client->bytesWrittenToBuffer = leftover;
}
client->bytesWrittenToBuffer = leftover;
}

}
Expand Down