From f1221a788e1906cb0e195c56ad48cb41f9d4e415 Mon Sep 17 00:00:00 2001
From: Eric Blankenhorn <eric@wolfssl.com>
Date: Tue, 14 Jul 2026 16:37:29 -0500
Subject: [PATCH] Coverity fixes

---
 examples/mqttnet.c | 8 ++++++++
 src/mqtt_packet.c  | 5 +++++
 src/mqtt_socket.c  | 4 ++++
 3 files changed, 17 insertions(+)

diff --git a/examples/mqttnet.c b/examples/mqttnet.c
index 19450be56..09bfb492e 100644
--- a/examples/mqttnet.c
+++ b/examples/mqttnet.c
@@ -173,6 +173,10 @@ static int NetRead(void *context, byte* buf, int buf_len,
     }
     else {
         rc = bytes;
+        /* Clamp to requested length so the return value cannot overflow */
+        if (rc > buf_len) {
+            rc = buf_len;
+        }
     }
 
     return rc;
@@ -1851,6 +1855,10 @@ static int NetRead_ex(void *context, byte* buf, int buf_len,
     }
     else {
         rc = bytes;
+        /* Clamp to requested length so the return value cannot overflow */
+        if (rc > buf_len) {
+            rc = buf_len;
+        }
     }
 
     return rc;
diff --git a/src/mqtt_packet.c b/src/mqtt_packet.c
index 2f78344ac..b5f37a017 100644
--- a/src/mqtt_packet.c
+++ b/src/mqtt_packet.c
@@ -4042,6 +4042,11 @@ int MqttPacket_Read(MqttClient *client, byte* rx_buf, int rx_buf_len,
                 if (rc <= 0) {
                     return MqttPacket_HandleNetError(client, rc);
                 }
+                /* Socket read must not return more than requested */
+                if (rc > remain_read) {
+                    return MqttPacket_HandleNetError(client,
+                        MQTT_TRACE_ERROR(MQTT_CODE_ERROR_NETWORK));
+                }
                 remain_read = rc;
             }
             break;
diff --git a/src/mqtt_socket.c b/src/mqtt_socket.c
index e6866203c..67c2559ca 100644
--- a/src/mqtt_socket.c
+++ b/src/mqtt_socket.c
@@ -356,6 +356,10 @@ int MqttSocket_Read(MqttClient *client, byte* buf, int buf_len, int timeout_ms)
         /* return length read and reset position */
         rc = client->read.pos;
         client->read.pos = 0;
+        /* Clamp to requested length so the return value cannot overflow */
+        if (rc > buf_len) {
+            rc = buf_len;
+        }
     }
 
     return rc;