diff options
author | Daniel Stenberg <daniel@haxx.se> | 2020-12-15 08:51:33 +0100 |
---|---|---|
committer | Daniel Stenberg <daniel@haxx.se> | 2020-12-15 08:51:33 +0100 |
commit | 0738fc636b44ebce8f91b3aff22f37ebd0d0e0a2 (patch) | |
tree | 4f67f26ffab529e49a0d9e62d3f370b249f62061 | |
parent | bc7ecc71c0c11d22fdbe6415a7945bfc43dc3c33 (diff) | |
download | curl-0738fc636b44ebce8f91b3aff22f37ebd0d0e0a2.tar.gz |
mqtt: deal with 0 byte reads correctlybagder/mqtt-shortread
OSS-Fuzz found it
Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28676
-rw-r--r-- | lib/mqtt.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/lib/mqtt.c b/lib/mqtt.c index e324ec3dd..a56c7d5eb 100644 --- a/lib/mqtt.c +++ b/lib/mqtt.c @@ -553,7 +553,7 @@ static CURLcode mqtt_doing(struct connectdata *conn, bool *done) case MQTT_FIRST: /* Read the initial byte only */ result = Curl_read(conn, sockfd, (char *)&mq->firstbyte, 1, &nread); - if(result) + if(!nread) break; Curl_debug(data, CURLINFO_HEADER_IN, (char *)&mq->firstbyte, 1); /* remember the first byte */ @@ -563,7 +563,7 @@ static CURLcode mqtt_doing(struct connectdata *conn, bool *done) case MQTT_REMAINING_LENGTH: do { result = Curl_read(conn, sockfd, (char *)&byte, 1, &nread); - if(result) + if(!nread) break; Curl_debug(data, CURLINFO_HEADER_IN, (char *)&byte, 1); pkt[mq->npacket++] = byte; |