[lwip-devel] [bug #57734] MQTT broken with muti-segments data

[David Bourgeois]

URL:
  <https://savannah.nongnu.org/bugs/?57734>

                 Summary: MQTT broken with muti-segments data
                 Project: lwIP - A Lightweight TCP/IP stack
            Submitted by: jaguarondi
            Submitted on: Mon 03 Feb 2020 09:33:19 PM UTC
                Category: apps
                Severity: 3 - Normal
              Item Group: Crash Error
                  Status: None
                 Privacy: Public
             Assigned to: None
             Open/Closed: Open
         Discussion Lock: Any
         Planned Release: None
            lwIP version: git head

    _______________________________________________________

Details:

I have a "Socket error on client..." since commit #2cc420e linked to bug
#55607

I found that when I subscribe to a "topic/#" that has a few retained
topics/values, the TCP packets are split into multiple segments that each hold
multiple MQTT topic/payload.

When the end of the segment contains the beginning of a topic (say 10 chars),
then the next segment get's the remaining of the topic and should write it on
rx_buffer[10], which was the role of cpy_start and that offset was applied in


pbuf_copy_partial(p, client->rx_buffer + cpy_start, cpy_len, in_offset);


The changes seems to remove this:

-      pbuf_copy_partial(p, client->rx_buffer + cpy_start, cpy_len,
in_offset);
+      pbuf_copy_partial(p, client->rx_buffer + fixed_hdr_len, cpy_len,
in_offset);


I compared cpy_start with fixed_hdr_len and when the problem appears,
cpy_start = 10 and fixed_hdr_len = 2 instead of 10.

I guess the problem can be reproduced by publishing various topics/subtopic
with long payload, then subscribing to topic/#.




    _______________________________________________________

Reply to this item at:

  <https://savannah.nongnu.org/bugs/?57734>

_______________________________________________
  Message sent via Savannah
  https://savannah.nongnu.org/