Fix Buffer Out of Bounds Error (#100)

bkp7 · web-flow · commit b6b73baf5c3a · 2021-02-12T16:06:52.000+01:00
* Code fix and additional tests. Refactor test function testParseGenerateDefaults() to allow just the parsing to be performed on its own.

* Modify testParseGenerateDefaults to take an partial packet object, generate the mqtt bytes, and then parse that buffer to a full packet object with defaults shown.

Add an additional testParseAndGenerate function which takes a packet and an mqtt bytes and tests they Parse and Generate in both directions.
diff --git a/parser.js b/parser.js
@@ -548,7 +548,7 @@ class Parser extends EventEmitter {
     let current
     const padding = this._pos ? this._pos : 0
 
-    while (bytes < maxBytes) {
+    while (bytes < maxBytes && (padding + bytes) < this._list.length) {
       current = this._list.readUInt8(padding + bytes++)
       value += mul * (current & constants.VARBYTEINT_MASK)
       mul *= 0x80
diff --git a/test.js b/test.js
@@ -97,6 +97,26 @@ function testGenerateOnly (name, object, buffer, opts) {
   })
 }
 
+function testParseOnly (name, object, buffer, opts) {
+  test(name, t => {
+    const parser = mqtt.parser(opts)
+    // const expected = object
+    // const fixture = buffer
+
+    t.plan(2 + Object.keys(object).length)
+
+    parser.on('packet', packet => {
+      t.equal(Object.keys(object).length, Object.keys(packet).length, 'key count')
+      Object.keys(object).forEach(key => {
+        t.deepEqual(packet[key], object[key], `expected packet property ${key}`)
+      })
+    })
+
+    t.equal(parser.parse(buffer), 0, 'remaining bytes')
+    t.end()
+  })
+}
+
 function testParseError (expected, fixture, opts) {
   test(expected, t => {
     t.plan(1)
@@ -138,28 +158,14 @@ function testGenerateErrorMultipleCmds (cmds, expected, fixture, opts) {
   )
 }
 
-function testParseGenerateDefaults (name, object, buffer, opts) {
-  test(`${name} parse`, t => {
-    const parser = mqtt.parser(opts)
-    const expected = object
-    const fixture = buffer
-
-    t.plan(1 + Object.keys(expected).length)
-
-    parser.on('packet', packet => {
-      Object.keys(expected).forEach(key => {
-        t.deepEqual(packet[key], expected[key], `expected packet property ${key}`)
-      })
-    })
-
-    t.equal(parser.parse(fixture), 0, 'remaining bytes')
-    t.end()
-  })
+function testParseGenerateDefaults (name, object, buffer, generated, opts) {
+  testParseOnly(`${name} parse`, generated, buffer, opts)
+  testGenerateOnly(`${name} generate`, object, buffer, opts)
+}
 
-  test(`${name} generate`, t => {
-    t.equal(mqtt.generate(object).toString('hex'), buffer.toString('hex'))
-    t.end()
-  })
+function testParseAndGenerate (name, object, buffer, opts) {
+  testParseOnly(`${name} parse`, object, buffer, opts)
+  testGenerateOnly(`${name} generate`, object, buffer, opts)
 }
 
 function testWriteToStreamError (expected, fixture) {
@@ -520,7 +526,66 @@ testParseGenerateDefaults('default connect', {
   16, 16, 0, 4, 77, 81, 84,
   84, 4, 2, 0, 0,
   0, 4, 116, 101, 115, 116
-]))
+]), {
+  cmd: 'connect',
+  retain: false,
+  qos: 0,
+  dup: false,
+  length: 16,
+  topic: null,
+  payload: null,
+  protocolId: 'MQTT',
+  protocolVersion: 4,
+  clean: true,
+  keepalive: 0,
+  clientId: 'test'
+})
+
+testParseAndGenerate('Version 4 CONACK', {
+  cmd: 'connack',
+  retain: false,
+  qos: 0,
+  dup: false,
+  length: 2,
+  topic: null,
+  payload: null,
+  sessionPresent: false,
+  returnCode: 1
+}, Buffer.from([
+  32, 2, // Fixed Header (CONNACK, Remaining Length)
+  0, 1 // Variable Header (Session not present, Connection Refused - unacceptable protocol version)
+]), {}) // Default protocolVersion (4)
+
+testParseAndGenerate('Version 5 CONACK', {
+  cmd: 'connack',
+  retain: false,
+  qos: 0,
+  dup: false,
+  length: 3,
+  topic: null,
+  payload: null,
+  sessionPresent: false,
+  reasonCode: 140
+}, Buffer.from([
+  32, 3, // Fixed Header (CONNACK, Remaining Length)
+  0, 140, // Variable Header (Session not present, Bad authentication method)
+  0 // Property Length Zero
+]), { protocolVersion: 5 })
+
+testParseOnly('Version 4 CONACK in Version 5 mode', {
+  cmd: 'connack',
+  retain: false,
+  qos: 0,
+  dup: false,
+  length: 2,
+  topic: null,
+  payload: null,
+  sessionPresent: false,
+  reasonCode: 1 // a version 4 return code stored in the version 5 reasonCode because this client is in version 5
+}, Buffer.from([
+  32, 2, // Fixed Header (CONNACK, Remaining Length)
+  0, 1 // Variable Header (Session not present, Connection Refused - unacceptable protocol version)
+]), { protocolVersion: 5 }) // message is in version 4 format, but this client is in version 5 mode
 
 testParseGenerate('empty will payload', {
   cmd: 'connect',
@@ -1903,6 +1968,19 @@ testParseGenerate('disconnect MQTT 5', {
   28, 0, 4, 116, 101, 115, 116// serverReference
 ]), { protocolVersion: 5 })
 
+testParseGenerate('disconnect MQTT 5 with no properties', {
+  cmd: 'disconnect',
+  retain: false,
+  qos: 0,
+  dup: false,
+  length: 2,
+  reasonCode: 0
+}, Buffer.from([
+  224, 2, // Fixed Header (DISCONNECT, Remaining Length)
+  0, // Reason Code (Normal Disconnection)
+  0 // Property Length (0 => No Properties)
+]), { protocolVersion: 5 })
+
 testParseGenerate('auth MQTT 5', {
   cmd: 'auth',
   retain: false,
