dangernoodle-io / breadboard / 27921112169

100%

push

github

fix: bb_mqtt_subscribe UAF — apply lock+destroyed-check+local-capture pattern from publish (#489)

- bb_mqtt_subscribe on espidf backend read h->client bare without taking
  h->lock or checking h->destroyed; concurrent bb_mqtt_destroy could free
  the underlying esp-mqtt handle mid-call (use-after-free)
- apply the same guard as bb_mqtt_publish (B1-296): take lock, check
  destroyed||client==NULL, capture local client pointer, release lock, then
  pass local pointer to esp_mqtt_client_subscribe
- add bb_log_w on the dead-handle path, matching publish
- host stub: add !handle || !topic guard to bb_mqtt_subscribe for parity
  (was silently ignoring NULL args)
- add 3 tests: null handle, null topic, happy path

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

1718 of 1718 branches covered (100.0%)

Branch coverage included in aggregate %.

2845 of 2845 relevant lines covered (100.0%)

1227.49 hits per line