buglwIP - A Lightweight TCP/IP stack - Bugs: bug #65920, mqtt_parse_incoming may cause dead...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #65920: mqtt_parse_incoming may cause dead loop when MQTT client parses invalid remaining length in fixed header

Submitter:  xiaoyanhao <xiaoyanhao>
Submitted:  Tue 25 Jun 2024 04:01:26 PM UTC
   
 
Category:  apps Severity:  3 - Normal
Item Group:  Faulty Behaviour Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  2.2.0

Tue 25 Jun 2024 04:01:26 PM UTC, original submission:  

Fixed header format of an MQTT Control Packet:
Bit       |    7    |    6    |    5    |    4    |    3    |    2    |    1    |    0    |
byte1    | MQTT Control Packet type  | Flags                                |
byte2... | Remaining Length                                                       |

> The Remaining Length is the number of bytes remaining within the current packet, including data in the variable header and the payload. The Remaining Length does not include the bytes used to encode the Remaining Length.
> The Remaining Length is encoded using a variable length encoding scheme which uses a single byte for values up to 127. Larger values are handled as follows. The least significant seven bits of each byte encode the data, and the most significant bit is used to indicate that there are following bytes in the representation. Thus each byte encodes 128 values and a "continuation bit". The maximum number of bytes in the Remaining Length field is four.


When the most significant bit(continuation bit) is always set in The Remaining Length such as 0xFF 0xFF 0xFF 0xFF, it would cause a dead loop.

while (p->tot_len > in_offset) {
  if ((fixed_hdr_len < 2) || ((b & 0x80) != 0)) { // b & 0x80 is always true
    fixed_hdr_len++;
    if (fixed_hdr_len >= 2) { // always true

The fixed_hdr_len should be equal or less than 5 bytes.

xiaoyanhao <xiaoyanhao>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #56205:  mqtt.c added by xiaoyanhao (48KiB - application/octet-stream - Simple patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by xiaoyanhao (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-06-25 xiaoyanhao Attached File- Added mqtt.c, #56205

    Back to the top

    Powered by Savane 3.15-e6e5.
    Corresponding source code