The result of converting the IP address of the broker wasn't checked. As a result, the pointer was left uninitialised and the IPv6 address used for connecting was some random data. The function now returns an error. Before connect_to_broker is called, mqtt_register is executed, which memsets conn to 0, making its state 0 (MQTT_CONN_STATE_ERROR). In order to recover from this error state, the extra check was added in the MQTT_CLIENT_STATE_NEWCONFIG state.
This was discovered using [CodeSonar](https://www.grammatech.com/products/codesonar)
1. The PT_MQTT_WAIT_SEND() macro has several issues:
- It does not check the return value from process_post(), which
sometimes returns an error code. See next issue.
- Each time the macro is called, is posts an event to itself. The idea
seems to be that the event should be absorbed by the macro itself, so
when the macro terminates there is NOT a net growth of the event
queue. This does not work. The reason is that the
PROCESS_WAIT_EVENT() sometimes absorbs a broadcast event instead of
its own event, and then the number of events in the event queue
increases. This leads to event explosions and overflow in the event
queue.
- The macro cannot call PT_EXIT(). This will expand to a return
statement, causing a return from the function calling the macro
(mqtt_process), rather then exiting the protothread (which was
probably the intention). Protothreads have lexical scope...
Fixes: 1) Check return value from process_post() 2) Loop until the
event posted to itself is absorbed (rather than just absorbing the
next event) 3) Replace PT_EXIT() with PT_INIT() (doesn't really make a
difference, could probably just be removed).
2. Change order of the checks in the protothread-calling loops in
mqtt_process(). Reason: When a protothread has been cleared by
PT_MQTT_WAIT_SEND(), it will not return a value, so checking against
PT_EXITED does not make sense.
3. PT_MQTT_WRITE_BYTES() should initialize conn->out_write_pos to 0.
When PT_MQTT_WRITE_BYTES() does not finish (due to TCP disconnect for
instance), it may leave conn->out_write_pos with a non-zero
value. Next time PT_MQTT_WRITE_BYTES() is called, it will take data
from the wrong place.
4. Put MQTT_CONN_STATE_ABORT_IMMEDIATE before
MQTT_CONN_STATE_NOT_CONNECTED in the enum list, so that the check
if(conn->state > MQTT_CONN_STATE_NOT_CONNECTED) in mqtt_connect()
fails when in state MQTT_CONN_STATE_ABORT_IMMEDIATE. Otherwise, it
will deadlock and not reattempt connections while in this state.
this simple change fixes the bug reported in @#1541.
../../apps/webserver/httpd.h:63:9: note: expected ‘uip_ip6addr_t’ but argument is of type ‘union uip_ipaddr_t *’
Plain text in the HTML header (think of <title>text</title>) is collected as usual. The decision to discard it is triggered by the first withspace following. In the usual case of the <body> no preceeded by any whitespace this means that by the point the first whitespace is encountered we're not in "discard mode" anymore and therefore incorrectly render the text.
Explicitly calling do_word() just before leaving "discard mode" discards all text collected so far.
" sprintf(numbuf, "0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x",...)" . the formatted data wrote to "numbuf" is 39 bytes, but numbuf is 32 bytes.
Niclas Finne
George Oikonomou
Peter Sjödin
Peter
Atis Elsts
Alexandru-Ioan Pop
Gaëtan Harter
Robert Olsson
George Oikonomou
Thomas Blank
Yasuyuki Tanaka
Mohamed Seliem
Antonio Lignan
aho
Oliver Schmidt
Nicolas Tsiftes
Joakim Nohlgård
Tiago Koji Castro Shibata
Simon Duquennoy
Simon Duquennoy
Antonio Lignan
zq301