From 0738fc636b44ebce8f91b3aff22f37ebd0d0e0a2 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Tue, 15 Dec 2020 08:51:33 +0100 Subject: mqtt: deal with 0 byte reads correctly OSS-Fuzz found it Bug: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28676 --- lib/mqtt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/mqtt.c b/lib/mqtt.c index e324ec3dd..a56c7d5eb 100644 --- a/lib/mqtt.c +++ b/lib/mqtt.c @@ -553,7 +553,7 @@ static CURLcode mqtt_doing(struct connectdata *conn, bool *done) case MQTT_FIRST: /* Read the initial byte only */ result = Curl_read(conn, sockfd, (char *)&mq->firstbyte, 1, &nread); - if(result) + if(!nread) break; Curl_debug(data, CURLINFO_HEADER_IN, (char *)&mq->firstbyte, 1); /* remember the first byte */ @@ -563,7 +563,7 @@ static CURLcode mqtt_doing(struct connectdata *conn, bool *done) case MQTT_REMAINING_LENGTH: do { result = Curl_read(conn, sockfd, (char *)&byte, 1, &nread); - if(result) + if(!nread) break; Curl_debug(data, CURLINFO_HEADER_IN, (char *)&byte, 1); pkt[mq->npacket++] = byte; -- cgit v1.2.1