Merge pull request #117 from IoTSharp/master

fix：fixed crash issues when the illegal topic is received

Author: maikebing

common/mqtt_list.c

@@ -5,8 +5,9 @@
  * @LastEditTime: 2020-04-27 23:28:12
  * @Description: the following code references TencentOS tiny, please keep the author information and source code according to the license.
  */
+#include <stddef.h>
+#include "mqtt_list.h"
 
-# include "mqtt_list.h"
 
 static void _mqtt_list_add(mqtt_list_t *node, mqtt_list_t *prev, mqtt_list_t *next)
 {
@@ -43,9 +44,13 @@ void mqtt_list_add_tail(mqtt_list_t *node, mqtt_list_t *list)
     _mqtt_list_add(node, list->prev, list);
 }
 
-void mqtt_list_del(mqtt_list_t *entry)
+void mqtt_list_del(mqtt_list_t* entry)
 {
-    _mqtt_list_del(entry->prev, entry->next);
+	if (entry == NULL) return;
+	if (entry->prev == NULL || entry->next == NULL) return;
+	_mqtt_list_del(entry->prev, entry->next);
+	entry->prev = NULL;
+	entry->next = NULL;
 }
 
 void mqtt_list_del_init(mqtt_list_t *entry)

mqtt/MQTTDeserializePublish.c

@@ -50,7 +50,7 @@ int MQTTDeserialize_publish(unsigned char* dup, int* qos, unsigned char* retaine
 	*qos = header.bits.qos;
 	*retained = header.bits.retain;
 
-	curdata += (rc = MQTTPacket_decodeBuf(curdata, &mylen)); /* read remaining length */
+	curdata += MQTTPacket_decodeBuf(curdata, &mylen); /* read remaining length */
 	enddata = curdata + mylen;
 
 	if (!readMQTTLenString(topicName, &curdata, enddata) ||

mqttclient/mqttclient.c

@@ -228,33 +228,58 @@ static int mqtt_is_topic_equals(const char *topic_filter, const char *topic)
     return 0;
 }
 
-static char mqtt_topic_is_matched(char* topic_filter, MQTTString* topic_name)
+// topic_filter: The filter string used in subscription (may contain +/#), e.g. a/+/c or foo/#
+// topic_name:   The actual topic received (should not contain wildcards), e.g. a/b/c or foo/bar
+static char mqtt_topic_is_matched(const char* topic_filter, MQTTString* topic_name)
 {
-    char* curf = topic_filter;
-    char* curn = topic_name->lenstring.data;
-    char* curn_end = curn + topic_name->lenstring.len;
-
-    while (*curf && curn < curn_end)
-    {
-        if (*curn == '/' && *curf != '/')
-            break;
-
-        /* support wildcards for MQTT topics, such as '#' '+' */
-        if (*curf != '+' && *curf != '#' && *curf != *curn)
-            break;
-
-        if (*curf == '+') {
-            char* nextpos = curn + 1;
-            while (nextpos < curn_end && *nextpos != '/')
-                nextpos = ++curn + 1;
+    const char* filter = topic_filter;
+    const char* topic = topic_name->lenstring.data;
+    int topic_len = topic_name == NULL || topic_name->lenstring.data == NULL || topic_name->lenstring.len <= 0 ? 0 : strnlen(topic, topic_name->lenstring.len);
+    int filter_len = strlen(filter);
+    int i = 0, j = 0;
+    while (i < filter_len && j < topic_len) {
+        if (filter[i] == '#') {
+            // '#' must be at the end and must be preceded by '/' or be the first character
+            if ((i == filter_len - 1) && (i == 0 || filter[i - 1] == '/')) {
+                return 1;
+            }
+            else {
+                return 0;
+            }
+        }
+        if (filter[i] == '+') {
+            // '+' must occupy an entire level
+            if ((i > 0 && filter[i - 1] != '/') || (i < filter_len - 1 && filter[i + 1] != '/' && filter[i + 1] != '\0')) {
+                return 0;
+            }
+            // Skip one level in the topic
+            while (j < topic_len && topic[j] != '/') j++;
+            i++;
         }
-        else if (*curf == '#')
-            curn = curn_end - 1;
-        curf++;
-        curn++;
-    };
+        else {
+            // Ordinary characters match one by one
+            if (filter[i] != topic[j]) {
+                return 0;
+            }
+            i++;
+            j++;
+        }
+        // Skip '/'
+        if (i < filter_len && filter[i] == '/' && j < topic_len && topic[j] == '/') {
+            i++;
+            j++;
+        }
+    }
 
-    return (curn == curn_end) && (*curf == '\0');
+    // Process ending
+    if (i == filter_len && j == topic_len) {
+        return 1;
+    }
+    // Allow ending with "/#" and topic is entirely consumed
+    if ((i == filter_len - 2) && filter[i] == '/' && filter[i + 1] == '#' && j == topic_len) {
+        return 1;
+    }
+    return 0;
 }
 
 static void mqtt_new_message_data(message_data_t* md, MQTTString* topic_name, mqtt_message_t* message)
@@ -442,8 +467,14 @@ static message_handlers_t *mqtt_msg_handler_create(const char* topic_filter, mqt
 static void mqtt_msg_handler_destory(message_handlers_t *msg_handler)
 {
     if (NULL != &msg_handler->list) {
+    
+        if (msg_handler->list.prev == NULL || msg_handler->list.next == NULL) return;
+    
         mqtt_list_del(&msg_handler->list);
+        msg_handler->list.prev == NULL;
+        msg_handler->list.next == NULL;
         platform_memory_free(msg_handler);
+        msg_handler = NULL;
     }
 }