From f857f6394f80d1846f13721cf6f761d25d41cc58 Mon Sep 17 00:00:00 2001
From: Deomid Ryabkov <rojer@cesanta.com>
Date: Wed, 6 Sep 2017 18:22:34 +0300
Subject: [PATCH] Access QoS field after validating topic length

PUBLISHED_FROM=6f2d9849d75ca1ec2b6dade11ccad8d0c5d4b3bd
---
 mongoose.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mongoose.c b/mongoose.c
index 8de1a665a..5e8193a46 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -10263,9 +10263,9 @@ int mg_mqtt_next_subscribe_topic(struct mg_mqtt_message *msg,
 
   topic->len = buf[0] << 8 | buf[1];
   topic->p = (char *) buf + 2;
-  *qos = buf[2 + topic->len];
   new_pos = pos + 2 + topic->len + 1;
   if ((size_t) new_pos > msg->payload.len) return -1;
+  *qos = buf[2 + topic->len];
   return new_pos;
 }
 
-- 
GitLab