Coverity fixes

examples/mqttnet.c

@@ -173,6 +173,10 @@ static int NetRead(void *context, byte* buf, int buf_len,
     }
     else {
         rc = bytes;
+        /* Clamp to requested length so the return value cannot overflow */
+        if (rc > buf_len) {
+            rc = buf_len;
+        }
     }
 
     return rc;
@@ -1851,6 +1855,10 @@ static int NetRead_ex(void *context, byte* buf, int buf_len,
     }
     else {
         rc = bytes;
+        /* Clamp to requested length so the return value cannot overflow */
+        if (rc > buf_len) {
+            rc = buf_len;
+        }
     }
 
     return rc;

src/mqtt_packet.c

@@ -4042,6 +4042,11 @@ int MqttPacket_Read(MqttClient *client, byte* rx_buf, int rx_buf_len,
                 if (rc <= 0) {
                     return MqttPacket_HandleNetError(client, rc);
                 }
+                /* Socket read must not return more than requested */
+                if (rc > remain_read) {
+                    return MqttPacket_HandleNetError(client,
+                        MQTT_TRACE_ERROR(MQTT_CODE_ERROR_NETWORK));
+                }
                 remain_read = rc;
             }
             break;

src/mqtt_socket.c

@@ -356,6 +356,10 @@ int MqttSocket_Read(MqttClient *client, byte* buf, int buf_len, int timeout_ms)
         /* return length read and reset position */
         rc = client->read.pos;
         client->read.pos = 0;
+        /* Clamp to requested length so the return value cannot overflow */
+        if (rc > buf_len) {
+            rc = buf_len;
+        }
     }
 
     return rc;