mqtt: read variable header independently from payload

lib/mqtt.c

@@ -691,8 +691,44 @@ static CURLcode mqtt_read_publish(struct Curl_easy *data, bool *done)
       goto end;
     }
 
+    /* read the variable header */
+
+    /* read topic */
+    size_t nprocessed = 0;
+    if (nread < 2) {
+      failf(data, "packet too short");
+      result = CURLE_WEIRD_SERVER_REPLY;
+      goto end;
+    }
+    nprocessed += 2;
+    size_t topiclen;
+    topiclen = (unsigned char)buffer[0] << 8 | (unsigned char)buffer[1];
+    if (nread < nprocessed + topiclen) {
+      failf(data, "topic length longer than read packet");
+      result = CURLE_WEIRD_SERVER_REPLY;
+      goto end;
+    }
+    result = Curl_client_write(data, CLIENTWRITE_HEADER, &buffer[nprocessed], topiclen);
+    if(result)
+      goto end;
+    nprocessed += topiclen;
+
     /* if QoS is set, message contains packet id */
-    result = Curl_client_write(data, CLIENTWRITE_BODY, buffer, nread);
+    if(mq->firstbyte & 0x06) {
+      if (nread < nprocessed + 2) {
+        failf(data, "packet too short");
+        result = CURLE_WEIRD_SERVER_REPLY;
+        goto end;
+      }
+      result = Curl_client_write(data, CLIENTWRITE_HEADER, &buffer[nprocessed], 2);
+      if(result)
+        goto end;
+      nprocessed += 2;
+    }
+
+    /* read payload */
+
+    result = Curl_client_write(data, CLIENTWRITE_BODY, &buffer[nprocessed], nread - nprocessed);
     if(result)
       goto end;