From 366194cde40d0cdea31248c8dbd2fe6dd4f81e20 Mon Sep 17 00:00:00 2001
From: Fredrik Fornwall <fredrik@fornwall.net>
Date: Sun, 16 Jul 2017 17:11:04 +0200
Subject: [PATCH 1/3] Replace getdtablesize() with sysconf(_SC_OPEN_MAX)

From http://man7.org/linux/man-pages/man3/getdtablesize.3.html:

"It is not specified in POSIX.1; portable applications should employ
sysconf(_SC_OPEN_MAX) instead of this call."

Specifically this fixes a build failure on Android which does not
have getdtablesize().

Signed-off-by: Fredrik Fornwall <fredrik@fornwall.net>
---
 src/loop.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/loop.c b/src/loop.c
index 3d068181..bf4876bc 100644
--- a/src/loop.c
+++ b/src/loop.c
@@ -21,6 +21,7 @@ Contributors:
 #include <assert.h>
 #ifndef WIN32
 #include <poll.h>
+#include <unistd.h>
 #else
 #include <process.h>
 #include <winsock2.h>
@@ -126,7 +127,7 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li
 #ifdef WIN32
 	pollfd_max = _getmaxstdio();
 #else
-	pollfd_max = getdtablesize();
+	pollfd_max = sysconf(_SC_OPEN_MAX);
 #endif
 
 	pollfds = _mosquitto_malloc(sizeof(struct pollfd)*pollfd_max);

From 0ba0bc434eba0c7b0d30110707e5b462be28b464 Mon Sep 17 00:00:00 2001
From: "Roger A. Light" <roger@atchoo.org>
Date: Wed, 5 Jul 2017 22:56:19 +0100
Subject: [PATCH 2/3] Use constant time memcmp for password checks.

---
 ChangeLog.txt          |  3 +++
 src/security_default.c | 22 +++++++++++++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/ChangeLog.txt b/ChangeLog.txt
index e83010eb..b56a8660 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -1,3 +1,6 @@
+Broker:
+- Use constant time memcmp for password comparisons.
+
 1.4.13 - 20170627
 =================
 
diff --git a/src/security_default.c b/src/security_default.c
index 43cd3f0c..c4085828 100644
--- a/src/security_default.c
+++ b/src/security_default.c
@@ -33,6 +33,9 @@ static int _pw_digest(const char *password, const unsigned char *salt, unsigned
 static int _base64_decode(char *in, unsigned char **decoded, unsigned int *decoded_len);
 #endif
 
+static int mosquitto__memcmp_const(const void *ptr1, const void *b, size_t len);
+
+
 int mosquitto_security_init_default(struct mosquitto_db *db, bool reload)
 {
 	int rc;
@@ -650,6 +653,23 @@ static int _psk_file_parse(struct mosquitto_db *db)
 	return MOSQ_ERR_SUCCESS;
 }
 
+
+static int mosquitto__memcmp_const(const void *a, const void *b, size_t len)
+{
+	int i;
+	int rc = 0;
+
+	if(!a || !b) return 1;
+
+	for(i=0; i<len; i++){
+		if( ((char *)a)[i] != ((char *)b)[i] ){
+			rc = 1;
+		}
+	}
+	return rc;
+}
+
+
 int mosquitto_unpwd_check_default(struct mosquitto_db *db, const char *username, const char *password)
 {
 	struct _mosquitto_unpwd *u, *tmp;
@@ -670,7 +690,7 @@ int mosquitto_unpwd_check_default(struct mosquitto_db *db, const char *username,
 #ifdef WITH_TLS
 					rc = _pw_digest(password, u->salt, u->salt_len, hash, &hash_len);
 					if(rc == MOSQ_ERR_SUCCESS){
-						if(hash_len == u->password_len && !memcmp(u->password, hash, hash_len)){
+						if(hash_len == u->password_len && !mosquitto__memcmp_const(u->password, hash, hash_len)){
 							return MOSQ_ERR_SUCCESS;
 						}else{
 							return MOSQ_ERR_AUTH;

From 5b73897f9892918f6148ea97bfa6ea998f196927 Mon Sep 17 00:00:00 2001
From: Zard1096 <mr.zardqi@gmail.com>
Date: Tue, 11 Jul 2017 13:08:38 +0800
Subject: [PATCH 3/3] Fix iOS crash issues

Relate to issues #327 and #63.
mosq->sock may be closed before FD_SET(mosq->sock, &writefds) and
FD_ISSET(mosq->sock, &writefds) but after judgement in line 947
if(mosq->sock != INVALID_SOCKET). FD_SET(-1, ...) and FD_ISSET(-1, ...)
would certainly crash.

Signed-off-by: Zard1096 <mr.zardqi@gmail.com>
---
 lib/mosquitto.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/mosquitto.c b/lib/mosquitto.c
index be8e62e5..61ffdd87 100644
--- a/lib/mosquitto.c
+++ b/lib/mosquitto.c
@@ -971,9 +971,10 @@ int mosquitto_loop(struct mosquitto *mosq, int timeout, int max_packets)
 				/* Fake write possible, to stimulate output write even though
 				 * we didn't ask for it, because at that point the publish or
 				 * other command wasn't present. */
-				FD_SET(mosq->sock, &writefds);
+				if(mosq->sock != INVALID_SOCKET)
+					FD_SET(mosq->sock, &writefds);
 			}
-			if(FD_ISSET(mosq->sock, &writefds)){
+			if(mosq->sock != INVALID_SOCKET && FD_ISSET(mosq->sock, &writefds)){
 #ifdef WITH_TLS
 				if(mosq->want_connect){
 					rc = mosquitto__socket_connect_tls(mosq);