Fix MQTT 5 property validation and QoS 2 state handling in broker and client

[aidangarske]

F-13223, F-13224, F-13237, F-13238

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #618

Scan targets checked: wolfmqtt-src, wolfmqtt-bugs

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

stale

[embhorn]

Skoll Code Review

Scan type: review

Overall recommendation: REQUEST_CHANGES
Findings: 10 total — 8 posted, 2 skipped
8 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [High] Byte-property range check added only to the encoder makes the broker silently drop v5 PUBLISHes it already ACKed as SUCCESS — src/mqtt_packet.c:917-924
• [Medium] Retained-store failure now suppresses live fan-out for v5 QoS 1/2 only, inverting QoS reliability ordering — src/mqtt_broker.c:7827-7839
• [Medium] MqttClient_Connect silently rewrites caller-owned MqttProp memory, contradicting the non-mutating pattern used three lines below — src/mqtt_client.c:3268-3282
• [Medium] New error branch and the changed v5 QoS 1 behavior have no tests — src/mqtt_broker.c:7148-7158
• [Low] MQTT_MAX_PROPS duplicated into a second .c file and a test instead of a public header — src/mqtt_client.c:29-34
• [Low] README still advertises Topic Alias without noting inbound aliases are now rejected — src/mqtt_client.c:1414-1429
• [Low] New line exceeds the project's 80-column limit — src/mqtt_client.c:1425
• [Low] Fan-out gate uses a preprocessor-conditional bare if stacked in front of another if — src/mqtt_broker.c:7831-7835

Skipped findings

• [Medium] New CONNECT refusal runs after the Will is stored, breaking the invariant BrokerClient_EndConnect documents
• [Low] New PUBLISH rejection frees properties regardless of doProps and is redundant on the packet_obj path

Review generated by Skoll

[embhorn]

Please review the Skoll feedback