search

eclipse / mosquitto.rsmb

Mosquitto rsmb
85 stars 42 forks source link

Crash when publishing an unregistered MQTT-SN topic #14

Closed ralight closed 8 years ago

ralight commented 8 years ago

migrated from Bugzilla #424692 status RESOLVED severity normal in component RSMB for --- Reported in version unspecified on platform PC Assigned to: Ian Craggs

Original attachment names and IDs:

On 2013-12-27 08:22:49 -0500, John Donovan wrote:

Created attachment 238579 Diff of NULL pointer exception fix.

When a client connects to the MQTT-SN broker and publishes an unregistered topic ID, the broker crashes.

In MQTTSProtocol_handlePublishers(), the topic name is searched for by its ID with the function MQTTSProtocol_getRegisteredTopicName(). If the ID cannot be found, MQTTSProtocol_getRegisteredTopicName() returns NULL. MQTTSProtocol_handlePublishers() doesn't check for NULL and tries to call strlen() on the NULL pointer which crashes.

To fix, I have put a NULL pointer check around the calls to strlen() and strcpy(), which means topicName is NULL, and is caught in the normal program flow.

I have supplied a diff with the necessary changes.

On 2013-12-29 06:31:31 -0500, Ian Craggs wrote:

Thanks. Registered topics are one of the two functions not yet implemented, but we should protect against this in any case.

On 2014-01-21 06:18:30 -0500, Ian Craggs wrote:

Fixed in master branch.