mqtt: return error for too long topic

Closes #9744

diff --git a/lib/mqtt.c b/lib/mqtt.c
index 7320747af028a24706b436fe4c4ac0ae9df33a72..bc9a3c12737b06c8b8bf2c9a53334611c3479943 100644 (file)
--- a/lib/mqtt.c
+++ b/lib/mqtt.c
@@ -389,10 +389,18 @@ static CURLcode mqtt_get_topic(struct Curl_easy *data,
                                char **topic, size_t *topiclen)
 {
   char *path = data->state.up.path;
-  if(strlen(path) > 1)
-    return Curl_urldecode(path + 1, 0, topic, topiclen, REJECT_NADA);
-  failf(data, "No MQTT topic found. Forgot to URL encode it?");
-  return CURLE_URL_MALFORMAT;
+  CURLcode result = CURLE_URL_MALFORMAT;
+  if(strlen(path) > 1) {
+    result = Curl_urldecode(path + 1, 0, topic, topiclen, REJECT_NADA);
+    if(!result && (*topiclen > 0xffff)) {
+      failf(data, "Too long MQTT topic");
+      result = CURLE_URL_MALFORMAT;
+    }
+  }
+  else
+    failf(data, "No MQTT topic found. Forgot to URL encode it?");
+
+  return result;
 }
 
 static CURLcode mqtt_subscribe(struct Curl_easy *data)