Skip to content

Avoid exceeding allocated buffers when doing MQTT proxying#8320

Merged
thebentern merged 2 commits into
meshtastic:developfrom
dirkmueller:mqtt_buffer_protection
Oct 13, 2025
Merged

Avoid exceeding allocated buffers when doing MQTT proxying#8320
thebentern merged 2 commits into
meshtastic:developfrom
dirkmueller:mqtt_buffer_protection

Conversation

@dirkmueller
Copy link
Copy Markdown
Contributor

the topic length could be longer than 65 characters. similarly for the payload.

🤝 Attestations

  • I have tested that my proposed changes behave as described.
  • I have tested that my proposed changes do not cause any obvious regressions on the following devices:
    • Heltec (Lora32) V3
    • LilyGo T-Deck
    • LilyGo T-Beam
    • RAK WisBlock 4631
    • Seeed Studio T-1000E tracker card
    • Other (please specify below)

the topic length could be longer than 65 characters. similarly for the
payload.
@CLAassistant
Copy link
Copy Markdown

CLAassistant commented Oct 12, 2025

CLA assistant check
All committers have signed the CLA.

@thebentern thebentern requested a review from Copilot October 13, 2025 11:56
@thebentern thebentern merged commit fe6509a into meshtastic:develop Oct 13, 2025
3 of 18 checks passed
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR fixes potential buffer overflow vulnerabilities in MQTT proxying by replacing unsafe string copying with bounds-checked operations and adding payload size validation.

  • Replaces strcpy with strlcpy to prevent topic buffer overflow
  • Adds length validation to prevent payload buffer overflow
  • Ensures safe copying of MQTT data within allocated buffer boundaries

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

Comment thread src/mqtt/MQTT.cpp
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants