yuanbiao
/
emqx
1
0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(emqx): validate mqtt malformed variable byte integer

This commit is contained in:
Shawn 2021-03-12 13:33:07 +08:00
parent c1f8d7de2f
commit 6fca40ff45
2 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/emqx_frame.erl
View File

@ -107,6 +107,9 @@ parse_remaining_len(<<0:8, Rest/binary>>, Header, 1, 0, Options) ->
%% Match PUBACK, PUBREC, PUBREL, PUBCOMP, UNSUBACK... %% Match PUBACK, PUBREC, PUBREL, PUBCOMP, UNSUBACK...
parse_remaining_len(<<0:1, 2:7, Rest/binary>>, Header, 1, 0, Options) -> parse_remaining_len(<<0:1, 2:7, Rest/binary>>, Header, 1, 0, Options) ->
parse_frame(Rest, Header, 2, Options); parse_frame(Rest, Header, 2, Options);
parse_remaining_len(<<1:1, _Len:7, _Rest/binary>>, _Header, Multiplier, _Value, _Options)
when Multiplier > 2097152 ->
error(malformed_variable_byte_integer);
parse_remaining_len(<<1:1, Len:7, Rest/binary>>, Header, Multiplier, Value, Options) -> parse_remaining_len(<<1:1, Len:7, Rest/binary>>, Header, Multiplier, Value, Options) ->
parse_remaining_len(Rest, Header, Multiplier * ?HIGHBIT, Value + Len * Multiplier, Options); parse_remaining_len(Rest, Header, Multiplier * ?HIGHBIT, Value + Len * Multiplier, Options);
parse_remaining_len(<<0:1, Len:7, Rest/binary>>, Header, Multiplier, Value, parse_remaining_len(<<0:1, Len:7, Rest/binary>>, Header, Multiplier, Value,

14
test/emqx_frame_SUITE.erl
View File

@ -23,7 +23,8 @@
-include_lib("eunit/include/eunit.hrl"). -include_lib("eunit/include/eunit.hrl").
all() -> all() ->
[{group, connect}, [{group, parse},
{group, connect},
{group, connack}, {group, connack},
{group, publish}, {group, publish},
{group, puback}, {group, puback},
@ -36,7 +37,10 @@ all() ->
{group, auth}]. {group, auth}].
groups() -> groups() ->
[{connect, [parallel], [{parse, [parallel],
[t_parse_frame_malformed_variable_byte_integer
]},
{connect, [parallel],
[serialize_parse_connect, [serialize_parse_connect,
serialize_parse_v3_connect, serialize_parse_v3_connect,
serialize_parse_v4_connect, serialize_parse_v4_connect,
@ -105,6 +109,12 @@ init_per_group(_Group, Config) ->
end_per_group(_Group, _Config) -> end_per_group(_Group, _Config) ->
ok. ok.
t_parse_frame_malformed_variable_byte_integer(_) ->
MalformedPayload = << <<16#80>> || _ <- lists:seq(1, 6) >>,
ParseState = emqx_frame:initial_parse_state(#{}),
?assertError(malformed_variable_byte_integer,
emqx_frame:parse(MalformedPayload, ParseState)).
serialize_parse_connect(_) -> serialize_parse_connect(_) ->
Packet1 = ?CONNECT_PACKET(#mqtt_packet_connect{}), Packet1 = ?CONNECT_PACKET(#mqtt_packet_connect{}),
?assertEqual(Packet1, parse_serialize(Packet1)), ?assertEqual(Packet1, parse_serialize(Packet1)),