wolfSSL · embhorn · Jul 10, 2026 · Jul 10, 2026 · Jul 10, 2026 · Jul 10, 2026
diff --git a/examples/firmware/fwpush.c b/examples/firmware/fwpush.c
@@ -50,6 +50,7 @@
 #include <wolfssl/wolfcrypt/hash.h>
 #endif
 
+#include <limits.h>
 #include "fwpush.h"
 #include "firmware.h"
 #include "examples/mqttexample.h"
@@ -84,51 +85,58 @@ static int mqtt_message_cb(MqttClient *client, MqttMessage *msg,
 static int mqtt_publish_cb(MqttPublish *publish) {
     int ret = -1;
 #if !defined(NO_FILESYSTEM)
-    size_t bytes_read;
     FwpushCBdata *cbData;
     FirmwareHeader *header;
     word32 headerSize;
+    int avail, chunk;
 
     /* Structure was stored in ctx pointer */
     if (publish != NULL) {
         cbData = (FwpushCBdata*)publish->ctx;
-        if (cbData != NULL) {
+        if (cbData != NULL && cbData->fwBuf != NULL) {
             header = (FirmwareHeader*)cbData->data;
+            /* Guard a corrupt offset so avail/chunk can never go negative and
+             * feed a negative length back into the publish state machine. */
+            if (cbData->fwOffset < 0 || cbData->fwOffset > cbData->fwLen) {
+                return -1;
+            }
+            avail = cbData->fwLen - cbData->fwOffset;
 
-            /* Check for first iteration of callback */
-            if (cbData->fp == NULL) {
-                /* Get FW size from FW header struct */
+            /* Stream from the in-memory signed firmware rather than reopening
+             * the file, so the bytes sent are exactly the bytes that were
+             * signed (no file-swap TOCTOU between build and send). */
+            if (!cbData->headerSent) {
                 headerSize = sizeof(FirmwareHeader) + header->sigLen +
                         header->pubKeyLen;
                 if (headerSize > publish->buffer_len) {
                     PRINTF("Error: Firmware Header %d larger than max buffer %d",
-                        headerSize, publish->buffer_len);
+                        (int)headerSize, publish->buffer_len);
                     return -1;
                 }
-
-                /* Copy header to buffer */
                 XMEMCPY(publish->buffer, header, headerSize);
-
-                /* Open file */
-                cbData->fp = fopen(cbData->filename, "rb");
-                if (cbData->fp != NULL) {
-                    /* read a buffer of data from the file */
-                    bytes_read = fread(&publish->buffer[headerSize],
-                            1, publish->buffer_len - headerSize, cbData->fp);
-                    if (bytes_read != 0) {
-                        ret = (int)bytes_read + headerSize;
-                    }
+                chunk = publish->buffer_len - (int)headerSize;
+                if (chunk > avail) {
+                    chunk = avail;
                 }
+                if (chunk > 0) {
+                    XMEMCPY(&publish->buffer[headerSize],
+                        &cbData->fwBuf[cbData->fwOffset], chunk);
+                    cbData->fwOffset += chunk;
+                }
+                cbData->headerSent = 1;
+                ret = (int)headerSize + chunk;
             }
             else {
-                /* read a buffer of data from the file */
-                bytes_read = fread(publish->buffer, 1, publish->buffer_len,
-                        cbData->fp);
-                ret = (int)bytes_read;
-            }
-            if (cbData->fp && feof(cbData->fp)) {
-                fclose(cbData->fp);
-                cbData->fp = NULL;
+                chunk = publish->buffer_len;
+                if (chunk > avail) {
+                    chunk = avail;
+                }
+                if (chunk > 0) {
+                    XMEMCPY(publish->buffer,
+                        &cbData->fwBuf[cbData->fwOffset], chunk);
+                    cbData->fwOffset += chunk;
+                }
+                ret = chunk;
             }
         }
     }
@@ -139,7 +147,7 @@ static int mqtt_publish_cb(MqttPublish *publish) {
 }
 
 static int fw_message_build(MQTTCtx *mqttCtx, const char* fwFile,
-    byte **p_msgBuf, int *p_msgLen)
+    byte **p_msgBuf, int *p_msgLen, byte **p_fwBuf, int *p_fwLen)
 {
     int rc;
     byte *msgBuf = NULL, *sigBuf = NULL, *keyBuf = NULL, *fwBuf = NULL;
@@ -232,6 +240,12 @@ static int fw_message_build(MQTTCtx *mqttCtx, const char* fwFile,
 #endif
 
     /* Assemble message */
+    /* guard the int msgLen sum against overflow on huge firmware */
+    if (fwLen > INT_MAX - (int)(sizeof(FirmwareHeader) + sigLen + keyLen)) {
+        PRINTF("Firmware file too large: %d bytes", fwLen);
+        rc = EXIT_FAILURE;
+        goto exit;
+    }
     msgLen = sizeof(FirmwareHeader) + sigLen + keyLen + fwLen;
 
     /* The firmware will be copied by the callback */
@@ -265,6 +279,14 @@ static int fw_message_build(MQTTCtx *mqttCtx, const char* fwFile,
         }
 
         if (p_msgLen) *p_msgLen = msgLen;
+
+        /* Transfer ownership of the signed firmware buffer so the callback
+         * streams the exact signed bytes instead of re-reading the file. */
+        if (p_fwBuf) {
+            *p_fwBuf = fwBuf;
+            fwBuf = NULL;
+        }
+        if (p_fwLen) *p_fwLen = fwLen;
     }
     else {
         if (msgBuf) WOLFMQTT_FREE(msgBuf);
@@ -445,7 +467,8 @@ int fwpush_test(MQTTCtx *mqttCtx)
             cbData->filename = mqttCtx->pub_file;
 
             rc = fw_message_build(mqttCtx, cbData->filename, &cbData->data,
-                    (int*)&mqttCtx->publish.total_len);
+                    (int*)&mqttCtx->publish.total_len,
+                    &cbData->fwBuf, &cbData->fwLen);
 
             /* The publish->ctx is available for use by the application to pass
              * data to the callback routine. */
@@ -539,6 +562,7 @@ int fwpush_test(MQTTCtx *mqttCtx)
         if (cbData) {
             if (cbData->fp) fclose(cbData->fp);
             if (cbData->data) WOLFMQTT_FREE(cbData->data);
+            if (cbData->fwBuf) WOLFMQTT_FREE(cbData->fwBuf);
             WOLFMQTT_FREE(cbData);
         }
         if (mqttCtx->publish.buffer) WOLFMQTT_FREE(mqttCtx->publish.buffer);

diff --git a/examples/firmware/fwpush.h b/examples/firmware/fwpush.h
@@ -33,6 +33,10 @@ typedef struct FwpushCBdata_s {
     const char *filename;
     byte *data;
     FILE *fp;
+    byte *fwBuf;   /* signed firmware held in memory, streamed by the callback */
+    int fwLen;
+    int fwOffset;
+    int headerSent;
 } FwpushCBdata;
 
 /* Exposed functions */

diff --git a/examples/mqttclient/mqttclient.c b/examples/mqttclient/mqttclient.c
@@ -143,11 +143,15 @@ static int mqtt_property_cb(MqttClient *client, MqttProp *head, void *ctx)
                 /* Store client ID in global */
                 mqttCtx->client_id = &gClientId[0];
 
-                /* Store assigned client ID from CONNACK*/
-                XSTRNCPY((char*)mqttCtx->client_id, prop->data_str.str,
-                         MAX_CLIENT_ID_LEN - 1);
-                /* should use strlcpy() semantics, but non-portable */
-                ((char*)mqttCtx->client_id)[MAX_CLIENT_ID_LEN - 1] = '\0';
+                /* copy bounded by decoded len; data_str.str is not NUL-terminated */
+                {
+                    word16 idLen = prop->data_str.len;
+                    if (idLen >= MAX_CLIENT_ID_LEN) {
+                        idLen = MAX_CLIENT_ID_LEN - 1;
+                    }
+                    XMEMCPY((char*)mqttCtx->client_id, prop->data_str.str, idLen);
+                    ((char*)mqttCtx->client_id)[idLen] = '\0';
+                }
                 break;
 
             case MQTT_PROP_SUBSCRIPTION_ID_AVAIL:

diff --git a/examples/nbclient/nbclient.c b/examples/nbclient/nbclient.c
@@ -132,11 +132,15 @@ static int mqtt_property_cb(MqttClient *client, MqttProp *head, void *ctx)
                 /* Store client ID in global */
                 mqttCtx->client_id = &gClientId[0];
 
-                /* Store assigned client ID from CONNACK*/
-                XSTRNCPY((char*)mqttCtx->client_id, prop->data_str.str,
-                         MAX_CLIENT_ID_LEN - 1);
-                /* should use strlcpy() semantics, but non-portable */
-                ((char*)mqttCtx->client_id)[MAX_CLIENT_ID_LEN - 1] = '\0';
+                /* copy bounded by decoded len; data_str.str is not NUL-terminated */
+                {
+                    word16 idLen = prop->data_str.len;
+                    if (idLen >= MAX_CLIENT_ID_LEN) {
+                        idLen = MAX_CLIENT_ID_LEN - 1;
+                    }
+                    XMEMCPY((char*)mqttCtx->client_id, prop->data_str.str, idLen);
+                    ((char*)mqttCtx->client_id)[idLen] = '\0';
+                }
                 break;
 
             case MQTT_PROP_SUBSCRIPTION_ID_AVAIL:

diff --git a/examples/pub-sub/mqtt-pub.c b/examples/pub-sub/mqtt-pub.c
@@ -75,11 +75,15 @@ static int mqtt_property_cb(MqttClient *client, MqttProp *head, void *ctx)
                 /* Store client ID in global */
                 mqttCtx->client_id = &gClientId[0];
 
-                /* Store assigned client ID from CONNACK*/
-                XSTRNCPY((char*)mqttCtx->client_id, prop->data_str.str,
-                         MAX_CLIENT_ID_LEN - 1);
-                /* should use strlcpy() semantics, but non-portable */
-                ((char*)mqttCtx->client_id)[MAX_CLIENT_ID_LEN - 1] = '\0';
+                /* copy bounded by decoded len; data_str.str is not NUL-terminated */
+                {
+                    word16 idLen = prop->data_str.len;
+                    if (idLen >= MAX_CLIENT_ID_LEN) {
+                        idLen = MAX_CLIENT_ID_LEN - 1;
+                    }
+                    XMEMCPY((char*)mqttCtx->client_id, prop->data_str.str, idLen);
+                    ((char*)mqttCtx->client_id)[idLen] = '\0';
+                }
                 break;
 
             case MQTT_PROP_SUBSCRIPTION_ID_AVAIL:

diff --git a/examples/pub-sub/mqtt-sub.c b/examples/pub-sub/mqtt-sub.c
@@ -145,11 +145,15 @@ static int mqtt_property_cb(MqttClient *client, MqttProp *head, void *ctx)
                 /* Store client ID in global */
                 mqttCtx->client_id = &gClientId[0];
 
-                /* Store assigned client ID from CONNACK*/
-                XSTRNCPY((char*)mqttCtx->client_id, prop->data_str.str,
-                         MAX_CLIENT_ID_LEN - 1);
-                /* should use strlcpy() semantics, but non-portable */
-                ((char*)mqttCtx->client_id)[MAX_CLIENT_ID_LEN - 1] = '\0';
+                /* copy bounded by decoded len; data_str.str is not NUL-terminated */
+                {
+                    word16 idLen = prop->data_str.len;
+                    if (idLen >= MAX_CLIENT_ID_LEN) {
+                        idLen = MAX_CLIENT_ID_LEN - 1;
+                    }
+                    XMEMCPY((char*)mqttCtx->client_id, prop->data_str.str, idLen);
+                    ((char*)mqttCtx->client_id)[idLen] = '\0';
+                }
                 break;
 
             case MQTT_PROP_SUBSCRIPTION_ID_AVAIL: