Fix: MQTT v5 Property-Packet Protocol Validation and Decode Safety

[kaabia]

Fixes #443

Summary

This pull request implements the required MQTT v5 protocol validation for properties and adds several buffer safety checks in the property decoding logic.

Key Changes

1. Protocol Compliance (Property Validation):

   • Implements the check in both MqttEncode_Props and MqttDecode_Props to ensure a property is only used in packet types defined by its packet_type_mask in gPropMatrix. This resolves the explicit TODO in both functions.
   • Introduces the new error code MQTT_CODE_ERROR_PROPERTY_MISMATCH for clear reporting of protocol violations.

2. Buffer Safety:

   • Added explicit boundary checks in MqttDecode_Props before decoding the property identifier (VBI) and before decoding property string data. This prevents potential buffer overruns if a packet length field is malformed or manipulated.

[wolfSSL-Bot]

Can one of the admins verify this patch?

[embhorn]

Hello @kaabia

Thanks for sharing this PR! Could you tell us a bit about your interest in the wolfMQTT project? We require all contributors to provide a signed agreement. You can send an email mentioning this PR to [email protected] to start this process.

Kind regards,
Eric - wolfSSL Support

[dgarske]

Hello @kaabia

Thanks for sharing this PR! Could you tell us a bit about your interest in the wolfMQTT project? We require all contributors to provide a signed agreement. You can send an email mentioning this PR to [email protected] to start this process.

Kind regards, Eric - wolfSSL Support

Hey @embhorn We got a signed contributor agreement from @kaabia , but I haven't see yet if its approved. See ZD 20757. He also submitted wolfSSL/wolfBoot#627

[kaabia]

Thank you for your review.
I also want to mention here also that the test gate is currently failing due to expired certificates that need updating in the test suite:

[2025/11/01 15:40:16:6281] E: SSL error: certificate has expired (preverify_ok=0;err=10;depth=1)

see #441
Thank you!

[embhorn]

Hi @kaabia

The fix for the expired certs is in. We are waiting on one more fix for the Espressif test. I'll let you know when to rebase and push.

[embhorn]

Hi @kaabia

Please rebase and push to restart the tests with the test fixes in place.

[kaabia]

Hi @kaabia

Please rebase and push to restart the tests with the test fixes in place.

Hi @embhorn,
Rebase done
Thank you for the notification.

[embhorn]

Thanks for sharing these changes. I am requesting one minor change.

[embhorn]

Thanks for updating the PR. Looking forward to reviewing any more updates you want to share.

[kaabia]

Thanks for updating the PR. Looking forward to reviewing any more updates you want to share.

Thank you as well! I sincerely appreciate your review and continued support. I'll be sure to share any further updates as soon as they are ready. 👍