Bug 549491 - mosquitto
Summary: mosquitto
Status: CLOSED MOVED
Alias: None
Product: Community
Classification: Eclipse Foundation
Component: Vulnerability Reports (show other bugs)
Version: unspecified   Edit
Hardware: PC Linux
: P3 normal (vote)
Target Milestone: ---   Edit
Assignee: Security vulnerabilitied reported against Eclipse projects CLA
QA Contact:
URL:
Whiteboard:
Keywords: security
Depends on:
Blocks:
 
Reported: 2019-07-23 11:24 EDT by Mohammad Reza Ramezani CLA
Modified: 2019-07-24 10:12 EDT (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Mohammad Reza Ramezani CLA 2019-07-23 11:24:06 EDT
I`m using the latest compatible version of this library in Ubuntu 16.04 and this bug still exist.

Consider the scenario:

Scenario:

    The broker is down and is not listening
    The publisher tries to connect to the broker
    Whether the connection is established or not, the publisher tries to publish a message . It must get 'MOSQ_ERR_NO_CONN' error message but It gets 'MOSQ_ERR_ERRNO' error message on account of a poor error handling.

This bad error handling leads to a memory leak. According to the QoS of the message, size of memory leak will be differ. If QoS is 0, the memory will be consumed as much as the payloadlen. If the QoS is 1, the size will be multiplied by two.
For example:
QoS=0, payloadlen=250MB --> Consumed memory in memory leak: 250MB
QoS=1, payloadlen=250MB --> Consumed memory in memory leak: 500MB

Here is the back trace:
https://github.com/eclipse/mosquitto/blob/master/lib/packet_mosq.c#L219
return MOSQ_ERR_ERRNO;
packet__write (packet_mosq.c#L219)
packet__queue (packet_mosq.c)
send__real_publish (send_publish.c)
send_publish (send_publish.c)


Note:
Maybe you say that is the publisher fault. He must check the connection status and then publish his message.
Yes, but the library is handling this exception and returning 'MOSQ_ERR_ERRNO' error message. So, it must complete the task and clean up the memory. otherwise, it seems a segmentation fault is better than a bad exception handling.
Comment 1 Roger Light CLA 2019-07-23 14:05:51 EDT
Thanks for the report. Do you have some example code that shows this behaviour? I've just tried to implement what I think you mean, but haven't been able to reproduce it. I've tried on version 1.6.3 and 1.4.8. I presume you mean version 1.4.8 by the latest version in Ubuntu 16.04, if not please let me know which version you mean.
Comment 2 Roger Light CLA 2019-07-24 08:07:54 EDT
I'm closing this issue because it has already been disclosed publicly at the normal bug tracker. The discussion can carry on there.

https://github.com/eclipse/mosquitto/issues/1345