From b5a43c416acda38d4f53a11e72347fbf35c6c99e Mon Sep 17 00:00:00 2001 From: Christian Kratky Date: Tue, 29 May 2018 21:39:40 +0200 Subject: [PATCH] Add validation of packet control type. --- .../Serializer/MqttPacketReader.cs | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/Frameworks/MQTTnet.NetStandard/Serializer/MqttPacketReader.cs b/Frameworks/MQTTnet.NetStandard/Serializer/MqttPacketReader.cs index 41239246..57755df9 100644 --- a/Frameworks/MQTTnet.NetStandard/Serializer/MqttPacketReader.cs +++ b/Frameworks/MQTTnet.NetStandard/Serializer/MqttPacketReader.cs @@ -12,7 +12,7 @@ namespace MQTTnet.Serializer { public static class MqttPacketReader { - public static async Task ReadHeaderAsync(IMqttChannel stream, CancellationToken cancellationToken) + public static async Task ReadHeaderAsync(IMqttChannel channel, CancellationToken cancellationToken) { if (cancellationToken.IsCancellationRequested) { @@ -23,20 +23,26 @@ namespace MQTTnet.Serializer // some large delay and thus the thread should be put back to the pool (await). So ReadByte() // is not an option here. var buffer = new byte[1]; - var readCount = await stream.ReadAsync(buffer, 0, buffer.Length, cancellationToken).ConfigureAwait(false); + var readCount = await channel.ReadAsync(buffer, 0, buffer.Length, cancellationToken).ConfigureAwait(false); if (readCount <= 0) { return null; } var fixedHeader = buffer[0]; - var controlPacketType = (MqttControlPacketType)(fixedHeader >> 4); - var bodyLength = await ReadBodyLengthAsync(stream, cancellationToken).ConfigureAwait(false); + var controlPacketType = fixedHeader >> 4; + + if (controlPacketType < 1 || controlPacketType > 14) + { + throw new MqttProtocolViolationException($"The packet type is invalid ({controlPacketType})."); + } + + var bodyLength = await ReadBodyLengthAsync(channel, cancellationToken).ConfigureAwait(false); return new MqttPacketHeader { FixedHeader = fixedHeader, - ControlPacketType = controlPacketType, + ControlPacketType = (MqttControlPacketType)controlPacketType, BodyLength = bodyLength }; }