From f8700e3f276051f41f9530644e2690719ed3c8ab Mon Sep 17 00:00:00 2001
From: Zaiming Shi <zmstone@gmail.com>
Date: Tue, 4 May 2021 12:21:56 +0200
Subject: [PATCH] fix(emqx_packet): no crash if publish packet has no data

---
 src/emqx_frame.erl         |  1 -
 src/emqx_packet.erl        | 13 ++++++++-----
 test/emqx_packet_SUITE.erl |  4 ++++
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/src/emqx_frame.erl b/src/emqx_frame.erl
index 1af2f010a..7e5aae788 100644
--- a/src/emqx_frame.erl
+++ b/src/emqx_frame.erl
@@ -156,7 +156,6 @@ parse_remaining_len(<<0:1, Len:7, Rest/binary>>, Header, Multiplier, Value,
 
 parse_frame(Bin, Header, 0, Options) ->
     {ok, packet(Header), Bin, ?none(Options)};
-
 parse_frame(Bin, Header, Length, Options) ->
     case Bin of
         <<FrameBin:Length/binary, Rest/binary>> ->
diff --git a/src/emqx_packet.erl b/src/emqx_packet.erl
index 1d8abcfba..a4d440ba1 100644
--- a/src/emqx_packet.erl
+++ b/src/emqx_packet.erl
@@ -251,13 +251,16 @@ set_props(Props, #mqtt_packet_auth{} = Pkt) ->
 %% @doc Check PubSub Packet.
 -spec(check(emqx_types:packet()|publish()|subscribe()|unsubscribe())
       -> ok | {error, emqx_types:reason_code()}).
-check(#mqtt_packet{variable = PubPkt}) when is_record(PubPkt, mqtt_packet_publish) ->
+check(#mqtt_packet{header = #mqtt_packet_header{type = ?PUBLISH},
+                   variable = PubPkt}) when not is_tuple(PubPkt) ->
+    %% publish without any data
+    %% disconnect instead of crash
+    {error, ?RC_PROTOCOL_ERROR};
+check(#mqtt_packet{variable = #mqtt_packet_publish{} = PubPkt}) ->
     check(PubPkt);
-
-check(#mqtt_packet{variable = SubPkt}) when is_record(SubPkt, mqtt_packet_subscribe) ->
+check(#mqtt_packet{variable = #mqtt_packet_subscribe{} = SubPkt}) ->
     check(SubPkt);
-
-check(#mqtt_packet{variable = UnsubPkt}) when is_record(UnsubPkt, mqtt_packet_unsubscribe) ->
+check(#mqtt_packet{variable = #mqtt_packet_unsubscribe{} = UnsubPkt}) ->
     check(UnsubPkt);
 
 %% A Topic Alias of 0 is not permitted.
diff --git a/test/emqx_packet_SUITE.erl b/test/emqx_packet_SUITE.erl
index 4c3221107..ae7b16a8a 100644
--- a/test/emqx_packet_SUITE.erl
+++ b/test/emqx_packet_SUITE.erl
@@ -309,3 +309,7 @@ t_format(_) ->
     io:format("~s", [emqx_packet:format(?UNSUBACK_PACKET(90))]),
     io:format("~s", [emqx_packet:format(?DISCONNECT_PACKET(128))]).
 
+t_parse_empty_publish(_) ->
+    %% 52: 0011(type=PUBLISH) 0100 (QoS=2)
+    {ok, Packet, <<>>, {none, _}} = emqx_frame:parse(<<52, 0>>),
+    ?assertEqual({error, ?RC_PROTOCOL_ERROR}, emqx_packet:check(Packet)).