ReconnectingMqttClient icon indicating copy to clipboard operation
ReconnectingMqttClient copied to clipboard

Buffer Overflow / Crash

Open jmscreation opened this issue 8 months ago • 0 comments

#define SMCBUFSIZE 1000 uint8_t buffer[SMCBUFSIZE]; The buffer allocates 1000 bytes by default, but there is no indication of this anywhere.

memcpy(&buffer[len], payload, payloadlen); This causes a memory buffer overflow to corrupt memory.

The maximum payload size is 1000, but should instead be dynamic. There should be cache buffer to continue pushing the data beyond a large payload size, instead of just writing into unknown memory. This is a major bug.

jmscreation avatar Apr 19 '25 04:04 jmscreation