CVE-2023-33658: Out-of-bounds Write (CWE-787)
value: A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_msg_get_pub_pid() in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2023-06-08T12:15Z
Repository: https://github.com/nanomq/NanoNNG
Language: C
Files changed: src/mqtt/transport/tls/mqtt_tls.c, src/sp/transport/mqtts/broker_tls.c, src/sp/transport/mqttws/nmq_websocket.c
Commit date: 2023-04-15 15:37:24 +0800
Commit message: * FIX [transport] fix #1153 https://github.com/emqx/nanomq/issues/1153 for other transport

Diff: diff --git a/src/mqtt/transport/tls/mqtt_tls.c b/src/mqtt/transport/tls/mqtt_tls.c
index 5178d413..75568759 100644
--- a/src/mqtt/transport/tls/mqtt_tls.c
+++ b/src/mqtt/transport/tls/mqtt_tls.c
@@ -693,12 +693,19 @@ mqtts_tcptran_pipe_recv_cb(void *arg)
 		if (qos_pac > 0) {
 			if (qos_pac == 1) {
 				ack_cmd = CMD_PUBACK;
 			} else if (qos_pac == 2) {
 				ack_cmd = CMD_PUBREC;
+			} else {
+				log_warn("Wrong QoS level!");
+				rv = PROTOCOL_ERROR;
+				goto recv_error;
+			}
+			if ((packet_id = nni_msg_get_pub_pid(msg)) == 0) {
+				rv = PROTOCOL_ERROR;
+				goto recv_error;
 			}
-			packet_id = nni_msg_get_pub_pid(msg);
 			ack = true;
 		}
 		break;
 	case CMD_PUBREC:
 		if (nni_mqtt_pubres_decode(msg, &packet_id, &reason_code, &prop,
diff --git a/src/sp/transport/mqtts/broker_tls.c b/src/sp/transport/mqtts/broker_tls.c
index e7adcb4a..c37a9636 100644
--- a/src/sp/transport/mqtts/broker_tls.c
+++ b/src/sp/transport/mqtts/broker_tls.c
@@ -715,12 +715,19 @@ tlstran_pipe_recv_cb(void *arg)
 			}
 			if (qos_pac == 1) {
 				ack_cmd = CMD_PUBACK;
 			} else if (qos_pac == 2) {
 				ack_cmd = CMD_PUBREC;
+			} else {
+				log_warn("Wrong QoS level!");
+				rv = PROTOCOL_ERROR;
+				goto recv_error;
+			}
+			if ((packet_id = nni_msg_get_pub_pid(msg)) == 0) {
+				rv = PROTOCOL_ERROR;
+				goto recv_error;
 			}
-			packet_id = nni_msg_get_pub_pid(msg);
 			ack       = true;
 		}
 	} else if (type == CMD_PUBREC) {
 		if (nni_mqtt_pubres_decode(msg, &packet_id, &reason_code, &prop,
 		        cparam->pro_ver) != 0) {
diff --git a/src/sp/transport/mqttws/nmq_websocket.c b/src/sp/transport/mqttws/nmq_websocket.c
index 768397ba..28503f34 100644
--- a/src/sp/transport/mqttws/nmq_websocket.c
+++ b/src/sp/transport/mqttws/nmq_websocket.c
@@ -248,13 +248,21 @@ done:
 
 				if (qos_pac == 1) {
 					ack_cmd = CMD_PUBACK;
 				} else if (qos_pac == 2) {
 					ack_cmd = CMD_PUBREC;
+				} else {
+					log_warn("Wrong QoS level!");
+					rv = PROTOCOL_ERROR;
+					goto recv_error;
+				}
+				if ((packet_id = nni_msg_get_pub_pid(msg)) ==
+				    0) {
+					rv = PROTOCOL_ERROR;
+					goto recv_error;
 				}
-				packet_id = nni_msg_get_pub_pid(smsg);
-				ack       = true;
+				ack = true;
 			}
 		} else if (cmd == CMD_PUBREC) {
 			if (nni_mqtt_pubres_decode(smsg, &packet_id, &reason_code, &prop,
 			        p->ws_param->pro_ver) != 0) {
 				log_trace("decode PUBREC variable header failed!");

Vulnerable code: 			packet_id = nni_msg_get_pub_pid(msg);
			packet_id = nni_msg_get_pub_pid(msg);
				packet_id = nni_msg_get_pub_pid(smsg);
				ack       = true;
Fixed code: 			} else {
				log_warn("Wrong QoS level!");
				rv = PROTOCOL_ERROR;
				goto recv_error;
			}
			if ((packet_id = nni_msg_get_pub_pid(msg)) == 0) {
				rv = PROTOCOL_ERROR;
				goto recv_error;
			} else {
				log_warn("Wrong QoS level!");
				rv = PROTOCOL_ERROR;
				goto recv_error;
			}
			if ((packet_id = nni_msg_get_pub_pid(msg)) == 0) {
				rv = PROTOCOL_ERROR;
				goto recv_error;
				} else {
					log_warn("Wrong QoS level!");
					rv = PROTOCOL_ERROR;
					goto recv_error;
				}
				if ((packet_id = nni_msg_get_pub_pid(msg)) ==
				    0) {
					rv = PROTOCOL_ERROR;
					goto recv_error;
				ack = true;