janiussyafiq commented on PR #13953: URL: https://github.com/apache/apisix/pull/13953#issuecomment-5707411859
A properties length that's a valid number (continuation bit clear) but larger than the packet still crashes, because `parsed_pos` skips past the buffer and the later `client_id_len` read does `str_byte(data, ...) * 256` on a nil. Repro packet: ``` 10 0c 00 04 4d 51 54 54 05 02 00 3c 7f 00 ``` 7f = properties length 127, so parsing jumps well past the 14-byte buffer. On this branch it gives the same uncaught error / connection reset instead of a 503: ``` mqtt-proxy.lua:119: attempt to perform arithmetic on a nil value lua entry thread aborted: runtime error ... ``` The root cause is that `parse_mqtt` does unchecked `str_byte(...) * 256` reads for both `protocol_len` and `client_id_len`. Worth guarding those two reads (or bounds-checking before each fixed read) so every malformed v5 CONNECT returns 503, not just the continuation-bit case. If you could alongside address this sibling issue that'd be great, thanks! -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
