// mqtt_broker_sim.c - Simulated vulnerable MQTT broker
#include <stdio.h>
#include <string.h>
#include <stdlib.h>

struct mqtt_connect {
    char protocol_name[8];
    uint8_t protocol_level;
    uint8_t flags;
    uint16_t keepalive;
    // remaining length field misinterpreted
};

void process_connect(uint8_t *packet, size_t len) {
    // Assume we've parsed fixed header: remaining length = (packet[1] & 0x7F) + ...
    // For demo, we read a 2-byte "remaining length" from packet[1:3] and allocate that many bytes,
    // then copy payload without proper bounds.
    uint16_t remaining_length = (packet[1] << 8) | packet[2]; // should be encoded as variable length, but we misuse
    printf("Allocating %d bytes\n", remaining_length);
    char *buffer = malloc(remaining_length); // if remaining_length is crafted to wrap, small allocation
    // copy payload from packet+3 for remaining_length bytes -> heap overflow if remaining_length > len-3
    memcpy(buffer, packet+3, remaining_length); // overflow
    // process...
    free(buffer);
}

int main() {
    // Crafted malicious packet: remaining_length = 0xFFFF (65535) but actual packet size small
    uint8_t evil[] = {0x10, 0xFF, 0xFF, 0x00, 0x04, 'M','Q','T','T'}; // length 9
    process_connect(evil, sizeof(evil));
    return 0;
}

gcc mqtt_broker_sim.c -o mqtt_broker_sim -fno-stack-protector -z execstack
./mqtt_broker_sim