From f1221a788e1906cb0e195c56ad48cb41f9d4e415 Mon Sep 17 00:00:00 2001
From: Eric Blankenhorn <eric@wolfssl.com>
Date: Tue, 14 Jul 2026 16:37:29 -0500
Subject: [PATCH 1/2] Coverity fixes

---
 examples/mqttnet.c | 8 ++++++++
 src/mqtt_packet.c  | 5 +++++
 src/mqtt_socket.c  | 4 ++++
 3 files changed, 17 insertions(+)

diff --git a/examples/mqttnet.c b/examples/mqttnet.c
index 19450be56..09bfb492e 100644
--- a/examples/mqttnet.c
+++ b/examples/mqttnet.c
@@ -173,6 +173,10 @@ static int NetRead(void *context, byte* buf, int buf_len,
     }
     else {
         rc = bytes;
+        /* Clamp to requested length so the return value cannot overflow */
+        if (rc > buf_len) {
+            rc = buf_len;
+        }
     }
 
     return rc;
@@ -1851,6 +1855,10 @@ static int NetRead_ex(void *context, byte* buf, int buf_len,
     }
     else {
         rc = bytes;
+        /* Clamp to requested length so the return value cannot overflow */
+        if (rc > buf_len) {
+            rc = buf_len;
+        }
     }
 
     return rc;
diff --git a/src/mqtt_packet.c b/src/mqtt_packet.c
index 2f78344ac..b5f37a017 100644
--- a/src/mqtt_packet.c
+++ b/src/mqtt_packet.c
@@ -4042,6 +4042,11 @@ int MqttPacket_Read(MqttClient *client, byte* rx_buf, int rx_buf_len,
                 if (rc <= 0) {
                     return MqttPacket_HandleNetError(client, rc);
                 }
+                /* Socket read must not return more than requested */
+                if (rc > remain_read) {
+                    return MqttPacket_HandleNetError(client,
+                        MQTT_TRACE_ERROR(MQTT_CODE_ERROR_NETWORK));
+                }
                 remain_read = rc;
             }
             break;
diff --git a/src/mqtt_socket.c b/src/mqtt_socket.c
index e6866203c..67c2559ca 100644
--- a/src/mqtt_socket.c
+++ b/src/mqtt_socket.c
@@ -356,6 +356,10 @@ int MqttSocket_Read(MqttClient *client, byte* buf, int buf_len, int timeout_ms)
         /* return length read and reset position */
         rc = client->read.pos;
         client->read.pos = 0;
+        /* Clamp to requested length so the return value cannot overflow */
+        if (rc > buf_len) {
+            rc = buf_len;
+        }
     }
 
     return rc;

From c0b6e6c02cd1ec6cfe3adae700a62eba5b06610f Mon Sep 17 00:00:00 2001
From: Eric Blankenhorn <eric@wolfssl.com>
Date: Wed, 15 Jul 2026 11:51:18 -0500
Subject: [PATCH 2/2] Fix from review

---
 examples/mqttnet.c | 13 ++++++++-----
 src/mqtt_socket.c  |  3 ++-
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/examples/mqttnet.c b/examples/mqttnet.c
index 09bfb492e..5abb22cf7 100644
--- a/examples/mqttnet.c
+++ b/examples/mqttnet.c
@@ -172,11 +172,13 @@ static int NetRead(void *context, byte* buf, int buf_len,
         rc = MQTT_CODE_ERROR_NETWORK;
     }
     else {
-        rc = bytes;
-        /* Clamp to requested length so the return value cannot overflow */
-        if (rc > buf_len) {
-            rc = buf_len;
+        /* Bound the byte count to buf_len before narrowing to int: this
+         * guards against a callback reporting more than was requested and
+         * keeps the word32->int cast within range */
+        if (bytes > (word32)buf_len) {
+            bytes = (word32)buf_len;
         }
+        rc = (int)bytes;
     }
 
     return rc;
@@ -1855,7 +1857,8 @@ static int NetRead_ex(void *context, byte* buf, int buf_len,
     }
     else {
         rc = bytes;
-        /* Clamp to requested length so the return value cannot overflow */
+        /* Never report more than the caller requested; guards against a
+         * read callback that returns more bytes than buf_len */
         if (rc > buf_len) {
             rc = buf_len;
         }
diff --git a/src/mqtt_socket.c b/src/mqtt_socket.c
index 67c2559ca..de65fc0ae 100644
--- a/src/mqtt_socket.c
+++ b/src/mqtt_socket.c
@@ -356,7 +356,8 @@ int MqttSocket_Read(MqttClient *client, byte* buf, int buf_len, int timeout_ms)
         /* return length read and reset position */
         rc = client->read.pos;
         client->read.pos = 0;
-        /* Clamp to requested length so the return value cannot overflow */
+        /* Never report more than the caller requested; guards against a
+         * read callback that returns more bytes than buf_len */
         if (rc > buf_len) {
             rc = buf_len;
         }