Heap buffer overread in MQTTPacket_decodeBuf() — VBI continuation bit reads past buffer

[afldl]

Heap buffer overread in MQTTPacket_decodeBuf() — VBI continuation bit reads past buffer

CWE-125: Out-of-bounds Read
Affected: Eclipse Paho MQTT C (current master)
File: MQTTPacket.c, lines 1098–1124

Summary

MQTTPacket_decodeBuf() calls MQTTPacket_VBIdecode() with a bufchar callback that reads past the buffer boundary when the Variable Byte Integer (VBI) continuation bit is set on the last byte. The bufchar callback performs no bounds checking.

Root Cause

/* MQTTPacket.c:1116 — no bounds check */
static char bufchar(char* buf, int idx)
{
    return buf[idx];  // reads past buffer when idx >= buflen
}

When a short input like \x00\xE3 is provided, the VBI parser reads byte 0, sees the continuation bit, and calls bufchar again for byte 1 which may be past the allocated buffer.

ASAN Output

ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602000000032
READ of size 1 at 0x602000000032
    #0 bufchar         MQTTPacket.c:1116:8
    #1 MQTTPacket_VBIdecode MQTTPacket.c:1098:8
    #2 MQTTPacket_decodeBuf  MQTTPacket.c:1124:9

PoC

2-byte input: \x00\xE3

Impact

• Heap OOB read (1 byte)
• Public API reachable via MQTTPacket_decodeBuf()
• Low severity — OOB read is small and data is used only for VBI remaining length parsing

Suggested Fix

Pass buffer length to MQTTPacket_VBIdecode and check bounds in the bufchar callback:

static char bufchar(char* buf, int idx, int buflen)
{
    if (idx >= buflen) return -1;  // or appropriate error
    return buf[idx];
}

Or add a length check inside MQTTPacket_VBIdecode before each getchar call.

Discovered through differential fuzzing of 5 MQTT implementations (PathDiff).