From 7cc8cb4f8816f511368c951343717b7989b20212 Mon Sep 17 00:00:00 2001 From: Turtle Date: Mon, 27 Sep 2021 22:32:29 +0800 Subject: [PATCH] fix(frame): variable byte integer could be larger than 4 bytes --- src/emqx.appup.src | 15 ++++++++------- src/emqx_frame.erl | 7 ++++++- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/src/emqx.appup.src b/src/emqx.appup.src index ae5c1e481..a90276d36 100644 --- a/src/emqx.appup.src +++ b/src/emqx.appup.src @@ -107,7 +107,8 @@ {load_module,emqx_pqueue,brutal_purge,soft_purge,[]}, {load_module,emqx_mqueue,brutal_purge,soft_purge,[]}, {load_module,emqx_alarm_handler,brutal_purge,soft_purge,[]}, - {load_module,emqx_misc,brutal_purge,soft_purge,[]} + {load_module,emqx_misc,brutal_purge,soft_purge,[]}, + {load_module, emqx_frame, brutal_purge, soft_purge, []} ]}, {<<"4.2.[6-7]">>, [ {load_module, emqx_channel, brutal_purge, soft_purge, []}, @@ -118,7 +119,8 @@ {load_module,emqx_pqueue,brutal_purge,soft_purge,[]}, {load_module,emqx_mqueue,brutal_purge,soft_purge,[]}, {load_module,emqx_alarm_handler,brutal_purge,soft_purge,[]}, - {load_module,emqx_misc,brutal_purge,soft_purge,[]} + {load_module,emqx_misc,brutal_purge,soft_purge,[]}, + {load_module, emqx_frame, brutal_purge, soft_purge, []} ]}, {<<"4.2.6">>, [ {load_module, emqx_channel, brutal_purge, soft_purge, []} @@ -231,7 +233,8 @@ {load_module,emqx_pqueue,brutal_purge,soft_purge,[]}, {load_module,emqx_mqueue,brutal_purge,soft_purge,[]}, {load_module,emqx_alarm_handler,brutal_purge,soft_purge,[]}, - {load_module,emqx_misc,brutal_purge,soft_purge,[]} + {load_module,emqx_misc,brutal_purge,soft_purge,[]}, + {load_module, emqx_frame, brutal_purge, soft_purge, []} ]}, {<<"4.2.[6-7]">>, [ {load_module, emqx_channel, brutal_purge, soft_purge, []}, @@ -242,10 +245,8 @@ {load_module,emqx_pqueue,brutal_purge,soft_purge,[]}, {load_module,emqx_mqueue,brutal_purge,soft_purge,[]}, {load_module,emqx_alarm_handler,brutal_purge,soft_purge,[]}, - {load_module,emqx_misc,brutal_purge,soft_purge,[]} - ]}, - {<<"4.2.6">>, [ - {load_module, emqx_channel, brutal_purge, soft_purge, []} + {load_module,emqx_misc,brutal_purge,soft_purge,[]}, + {load_module, emqx_frame, brutal_purge, soft_purge, []} ]}, {<<".*">>, []} ] diff --git a/src/emqx_frame.erl b/src/emqx_frame.erl index 94fbda4b7..133c1c0fd 100644 --- a/src/emqx_frame.erl +++ b/src/emqx_frame.erl @@ -67,6 +67,8 @@ version => ?MQTT_PROTO_V4 }). +-define(MULTIPLIER_MAX, 16#200000). + -dialyzer({no_match, [serialize_utf8_string/2]}). %%-------------------------------------------------------------------- @@ -142,7 +144,7 @@ parse_remaining_len(<<0:8, Rest/binary>>, Header, 1, 0, Options) -> parse_remaining_len(<<0:1, 2:7, Rest/binary>>, Header, 1, 0, Options) -> parse_frame(Rest, Header, 2, Options); parse_remaining_len(<<1:1, _Len:7, _Rest/binary>>, _Header, Multiplier, _Value, _Options) - when Multiplier > 2097152 -> + when Multiplier > ?MULTIPLIER_MAX -> error(malformed_variable_byte_integer); parse_remaining_len(<<1:1, Len:7, Rest/binary>>, Header, Multiplier, Value, Options) -> parse_remaining_len(Rest, Header, Multiplier * ?HIGHBIT, Value + Len * Multiplier, Options); @@ -411,6 +413,9 @@ parse_property(<<16#2A, Val, Bin/binary>>, Props) -> parse_variable_byte_integer(Bin) -> parse_variable_byte_integer(Bin, 1, 0). +parse_variable_byte_integer(<<1:1, _Len:7, _Rest/binary>>, Multiplier, _Value) + when Multiplier > ?MULTIPLIER_MAX -> + error(malformed_variable_byte_integer); parse_variable_byte_integer(<<1:1, Len:7, Rest/binary>>, Multiplier, Value) -> parse_variable_byte_integer(Rest, Multiplier * ?HIGHBIT, Value + Len * Multiplier); parse_variable_byte_integer(<<0:1, Len:7, Rest/binary>>, Multiplier, Value) ->