Describe the bug
For MQTT versions below 5, pack->properties is left uninitialized because Suback is allocated using malloc(). On an error path, pack->properties.array is evaluated in a conditional cleanup check. Since the member is uninitialized, this can result in an invalid pointer being passed to free(), causing a crash.
On the affected system, the uninitialized properties.array happened to contain a non-zero value, causing the cleanup code to call free() on an invalid address.
Expected behavior
No crash occurs with MQTT version below 5.
Environment (please complete the following information):
Linux
Additional context
Crash discovered while performing fuzz testing. With the attached patched applied, the crash does not occur anymore.
Patch
0001-Fix-uninitialized-properties-can-cause-crash-in-free.patch
Describe the bug
For MQTT versions below 5,
pack->propertiesis left uninitialized becauseSubackis allocated usingmalloc(). On an error path,pack->properties.arrayis evaluated in a conditional cleanup check. Since the member is uninitialized, this can result in an invalid pointer being passed tofree(), causing a crash.On the affected system, the uninitialized
properties.arrayhappened to contain a non-zero value, causing the cleanup code to callfree()on an invalid address.Expected behavior
No crash occurs with MQTT version below 5.
Environment (please complete the following information):
Linux
Additional context
Crash discovered while performing fuzz testing. With the attached patched applied, the crash does not occur anymore.
Patch
0001-Fix-uninitialized-properties-can-cause-crash-in-free.patch