bound remain_len in publishresp, disconnect and auth decoders

[jmestwa-coder]

reason code byte read past rx_buf in three v5 ack decoders:

• MqttDecode_PublishResp reads the reason code gated on remain_len, not rx_buf_len
• MqttDecode_Disconnect and MqttDecode_Auth do the same one byte after the fixed header
• a frame claiming a reason code but ending at the header steps one byte past the caller buffer

added the rx_buf_len < header_len + remain_len guard that MqttDecode_Connect and MqttDecode_Subscribe already carry, plus regression tests that fault pre-patch and return out-of-buffer after.

[wolfSSL-Bot]

Can one of the admins verify this patch?

[embhorn]

Hi @jmestwa-coder

Thanks for contacting wolfSSL with this fix. We do not typically accept small fixes from new contributors. I will request these to be addressed in #552

Kind regards,
@embhorn - wolfSSL Support

[jmestwa-coder]

No problem, makes sense to roll these into #552. For reference the guards go right after MqttDecode_FixedHeader in MqttDecode_PublishResp, MqttDecode_Disconnect and MqttDecode_Auth, mirroring the same check MqttDecode_Connect and MqttDecode_Subscribe already carry. There are three failing regression tests in tests/test_mqtt_packet.c covering each one if they're useful to pull across. Happy for you to close this out.

[embhorn]

Closing this PR as it was superseded by #552