summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorDaniel Stenberg <daniel@haxx.se>2020-12-17 13:34:38 +0100
committerDaniel Stenberg <daniel@haxx.se>2020-12-18 12:54:05 +0100
commitdebf23eead5a67b82bae668929c798196a42adc3 (patch)
tree4161cb9af5e7ccb8638c89e63dfb6fbac9c8d6d5 /lib
parent92fe66c5109211519df1ef32d752dbecc34e53c7 (diff)
downloadcurl-debf23eead5a67b82bae668929c798196a42adc3.tar.gz
mqtt: handle POST/PUBLISH without a set POSTFIELDSIZE
Detected by OSS-Fuzz Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28735 Added test 1916 and 1917 to verify. Closes #6338
Diffstat (limited to 'lib')
-rw-r--r--lib/mqtt.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/lib/mqtt.c b/lib/mqtt.c
index a56c7d5eb..71a00cfc2 100644
--- a/lib/mqtt.c
+++ b/lib/mqtt.c
@@ -319,7 +319,7 @@ static CURLcode mqtt_publish(struct connectdata *conn)
{
CURLcode result;
char *payload = conn->data->set.postfields;
- size_t payloadlen = (size_t)conn->data->set.postfieldsize;
+ size_t payloadlen;
char *topic = NULL;
size_t topiclen;
unsigned char *pkt = NULL;
@@ -327,6 +327,14 @@ static CURLcode mqtt_publish(struct connectdata *conn)
size_t remaininglength;
size_t encodelen;
char encodedbytes[4];
+ curl_off_t postfieldsize = conn->data->set.postfieldsize;
+
+ if(!payload)
+ return CURLE_BAD_FUNCTION_ARGUMENT;
+ if(postfieldsize < 0)
+ payloadlen = strlen(payload);
+ else
+ payloadlen = (size_t)postfieldsize;
result = mqtt_get_topic(conn, &topic, &topiclen);
if(result)