Merge branch 'fixes'

2019-04-30 14:33:51 +01:00 · 2019-04-30 14:33:51 +01:00 · f825d4bb5e
commit f825d4bb5e
parent d526433800 0e58a5e94e
29 changed files with 228 additions and 40 deletions
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@ -11,7 +11,7 @@ project(mosquitto)
 cmake_minimum_required(VERSION 2.8)
 # Only for version 3 and up. cmake_policy(SET CMP0042 NEW)

-set (VERSION 1.6.1)
+set (VERSION 1.6.2)

 add_definitions (-DCMAKE -DVERSION=\"${VERSION}\")

--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@ -1,3 +1,27 @@
+1.6.2 - 20190430
+================
+
+Broker:
+- Fix memory access after free, leading to possible crash, when v5 client with
+  Will message disconnects, where the Will message has as its first property
+  one of `content-type`, `correlation-data`, `payload-format-indicator`, or
+  `response-topic`.  Closes #1244.
+- Fix build for WITH_TLS=no. Closes #1250.
+- Fix Will message not allowing user-property properties.
+- Fix broker originated messages (e.g. $SYS/broker/version) not being
+  published when `check_retain_source` set to true. Closes #1245.
+- Fix $SYS/broker/version being incorrectly expired after 60 seconds.
+  Closes #1245.
+
+Library:
+- Fix crash after client has been unable to connect to a broker. This occurs
+  when the client is exiting and is part of the final library cleanup routine.
+  Closes #1246.
+
+Clients:
+- Fix -L url parsing. Closes #1248.
+
+
 1.6.1 - 20190426
 ================

--- a/client/client_shared.c
+++ b/client/client_shared.c
@ -669,13 +669,13 @@ int client_config_line_proc(struct mosq_config *cfg, int pub_or_sub, int argc, c

 				tmp = strchr(url, '@');
 				if(tmp) {
-					char *colon = strchr(url, ':');
 					*tmp++ = 0;
+					char *colon = strchr(url, ':');
 					if(colon) {
 						*colon = 0;
-						cfg->password = colon + 1;
+						cfg->password = strdup(colon + 1);
 					}
-					cfg->username = url;
+					cfg->username = strdup(url);
 					url = tmp;
 				}
 				cfg->host = url;
@ -685,6 +685,8 @@ int client_config_line_proc(struct mosq_config *cfg, int pub_or_sub, int argc, c
 					*tmp++ = 0;
 					cfg->port = atoi(tmp);
 				}
+				/* Now we've removed the port, time to get the host on the heap */
+				cfg->host = strdup(cfg->host);
 			}
 			i++;
 		}else if(!strcmp(argv[i], "-l") || !strcmp(argv[i], "--stdin-line")){
--- a/config.mk
+++ b/config.mk
@ -104,7 +104,7 @@ WITH_COVERAGE:=no

 # Also bump lib/mosquitto.h, CMakeLists.txt,
 # installer/mosquitto.nsi, installer/mosquitto64.nsi
-VERSION=1.6.1
+VERSION=1.6.2

 # Client library SO version. Bump if incompatible API/ABI changes are made.
 SOVERSION=1
--- a/installer/mosquitto.nsi
+++ b/installer/mosquitto.nsi
@ -9,7 +9,7 @@
 !define env_hklm 'HKLM "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"'

 Name "Eclipse Mosquitto"
-!define VERSION 1.6.1
+!define VERSION 1.6.2
 OutFile "mosquitto-${VERSION}-install-windows-x86.exe"

 InstallDir "$PROGRAMFILES\mosquitto"
--- a/installer/mosquitto64.nsi
+++ b/installer/mosquitto64.nsi
@ -9,7 +9,7 @@
 !define env_hklm 'HKLM "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"'

 Name "Eclipse Mosquitto"
-!define VERSION 1.6.1
+!define VERSION 1.6.2
 OutFile "mosquitto-${VERSION}-install-windows-x64.exe"

 !include "x64.nsh"
@ -82,7 +82,7 @@ Section "Files" SecInstall
 SectionEnd

 Section "Service" SecService
-	ExeWait '"$INSTDIR\mosquitto.exe" install'
+	ExecWait '"$INSTDIR\mosquitto.exe" install'
 SectionEnd

 Section "Uninstall"
--- a/lib/CMakeLists.txt
+++ b/lib/CMakeLists.txt
@ -89,7 +89,7 @@ set_target_properties(libmosquitto PROPERTIES
 	SOVERSION 1
 )

-install(TARGETS libmosquitto LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}")
+install(TARGETS libmosquitto RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}")

 if (WITH_STATIC_LIBRARIES)
 	add_library(libmosquitto_static STATIC ${C_SRC})
--- a/lib/cpp/CMakeLists.txt
+++ b/lib/cpp/CMakeLists.txt
@ -13,7 +13,7 @@ set_target_properties(mosquittopp PROPERTIES
 	VERSION ${VERSION}
 	SOVERSION 1
 )
-install(TARGETS mosquittopp LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}")
+install(TARGETS mosquittopp RUNTIME DESTINATION "${CMAKE_INSTALL_BINDIR}" LIBRARY DESTINATION "${CMAKE_INSTALL_LIBDIR}")

 if (WITH_STATIC_LIBRARIES)
 	add_library(mosquittopp_static STATIC
--- a/lib/mosquitto.h
+++ b/lib/mosquitto.h
@ -48,7 +48,7 @@ extern "C" {

 #define LIBMOSQUITTO_MAJOR 1
 #define LIBMOSQUITTO_MINOR 6
-#define LIBMOSQUITTO_REVISION 1
+#define LIBMOSQUITTO_REVISION 2
 /* LIBMOSQUITTO_VERSION_NUMBER looks like 1002001 for e.g. version 1.2.1. */
 #define LIBMOSQUITTO_VERSION_NUMBER (LIBMOSQUITTO_MAJOR*1000000+LIBMOSQUITTO_MINOR*1000+LIBMOSQUITTO_REVISION)

--- a/lib/net_mosq.c
+++ b/lib/net_mosq.c
@ -107,6 +107,7 @@ static void cleanup_ui_method(void)
 {
 	if(_ui_method){
 		UI_destroy_method(_ui_method);
+		_ui_method = NULL;
 	}
 }

--- a/set-version.sh
+++ b/set-version.sh
@ -2,7 +2,7 @@

 MAJOR=1
 MINOR=6
-REVISION=1
+REVISION=2

 sed -i "s/^VERSION=.*/VERSION=${MAJOR}.${MINOR}.${REVISION}/" config.mk

--- a/snap/snapcraft.yaml
+++ b/snap/snapcraft.yaml
@ -1,5 +1,5 @@
 name: mosquitto
-version: 1.6.1
+version: 1.6.2
 summary: Eclipse Mosquitto MQTT broker
 description: This is a message broker that supports version 3.1 and 3.1.1 of the MQTT
    protocol.
--- a/src/database.c
+++ b/src/database.c
@ -580,6 +580,7 @@ int db__messages_easy_queue(struct mosquitto_db *db, struct mosquitto *context,
 	char *topic_heap;
 	mosquitto__payload_uhpa payload_uhpa;
 	mosquitto_property *local_properties = NULL;
+	enum mosquitto_msg_origin origin;

 	assert(db);

@ -608,13 +609,19 @@ int db__messages_easy_queue(struct mosquitto_db *db, struct mosquitto *context,
 		local_properties = *properties;
 		*properties = NULL;
 	}
-	if(db__message_store(db, context, 0, topic_heap, qos, payloadlen, &payload_uhpa, retain, &stored, message_expiry_interval, local_properties, 0)) return 1;
+
+	if(context){
+		origin = mosq_mo_client;
+	}else{
+		origin = mosq_mo_broker;
+	}
+	if(db__message_store(db, context, 0, topic_heap, qos, payloadlen, &payload_uhpa, retain, &stored, message_expiry_interval, local_properties, 0, origin)) return 1;

 	return sub__messages_queue(db, source_id, topic_heap, qos, retain, &stored);
 }

 /* This function requires topic to be allocated on the heap. Once called, it owns topic and will free it on error. Likewise payload and properties. */
-int db__message_store(struct mosquitto_db *db, const struct mosquitto *source, uint16_t source_mid, char *topic, int qos, uint32_t payloadlen, mosquitto__payload_uhpa *payload, int retain, struct mosquitto_msg_store **stored, uint32_t message_expiry_interval, mosquitto_property *properties, dbid_t store_id)
+int db__message_store(struct mosquitto_db *db, const struct mosquitto *source, uint16_t source_mid, char *topic, int qos, uint32_t payloadlen, mosquitto__payload_uhpa *payload, int retain, struct mosquitto_msg_store **stored, uint32_t message_expiry_interval, mosquitto_property *properties, dbid_t store_id, enum mosquitto_msg_origin origin)
 {
 	struct mosquitto_msg_store *temp = NULL;
 	int rc = MOSQ_ERR_SUCCESS;
@ -662,6 +669,7 @@ int db__message_store(struct mosquitto_db *db, const struct mosquitto *source, u
 	topic = NULL;
 	temp->payloadlen = payloadlen;
 	temp->properties = properties;
+	temp->origin = origin;
 	if(payloadlen){
 		UHPA_MOVE(temp->payload, *payload, payloadlen);
 	}else{
--- a/src/handle_connect.c
+++ b/src/handle_connect.c
@ -292,7 +292,7 @@ static int will__read(struct mosquitto *context, struct mosquitto_message_all **
 		rc = property__read_all(CMD_WILL, &context->in_packet, &properties);
 		if(rc) goto error_cleanup;

-		rc = property__process_will(context, will_struct, properties);
+		rc = property__process_will(context, will_struct, &properties);
 		mosquitto_property_free_all(&properties);
 		if(rc) goto error_cleanup;
 	}
@ -502,7 +502,7 @@ int handle__connect(struct mosquitto_db *db, struct mosquitto *context)
 		rc = property__read_all(CMD_CONNECT, &context->in_packet, &properties);
 		if(rc) goto handle_connect_error;
 	}
-	property__process_connect(context, properties);
+	property__process_connect(context, &properties);

 	if(mosquitto_property_read_string(properties, MQTT_PROP_AUTHENTICATION_METHOD, &context->auth_method, false)){
 		mosquitto_property_read_binary(properties, MQTT_PROP_AUTHENTICATION_DATA, &auth_data, &auth_data_len, false);
--- a/src/handle_disconnect.c
+++ b/src/handle_disconnect.c
@ -43,7 +43,7 @@ int handle__disconnect(struct mosquitto_db *db, struct mosquitto *context)
 			if(rc) return rc;
 		}
 	}
-	rc = property__process_disconnect(context, properties);
+	rc = property__process_disconnect(context, &properties);
 	if(rc){
 		if(rc == MOSQ_ERR_PROTOCOL){
 			send__disconnect(context, MQTT_RC_PROTOCOL_ERROR, NULL);
--- a/src/handle_publish.c
+++ b/src/handle_publish.c
@ -300,7 +300,7 @@ int handle__publish(struct mosquitto_db *db, struct mosquitto *context)
 	}
 	if(!stored){
 		dup = 0;
-		if(db__message_store(db, context, mid, topic, qos, payloadlen, &payload, retain, &stored, message_expiry_interval, msg_properties, 0)){
+		if(db__message_store(db, context, mid, topic, qos, payloadlen, &payload, retain, &stored, message_expiry_interval, msg_properties, 0, mosq_mo_client)){
 			mosquitto_property_free_all(&msg_properties);
 			return 1;
 		}
--- a/src/mosquitto_broker_internal.h
+++ b/src/mosquitto_broker_internal.h
@ -157,6 +157,12 @@ typedef int (*FUNC_auth_plugin_acl_check_v2)(void *, const char *, const char *,
 typedef int (*FUNC_auth_plugin_unpwd_check_v2)(void *, const char *, const char *);
 typedef int (*FUNC_auth_plugin_psk_key_get_v2)(void *, const char *, const char *, char *, int);

+
+enum mosquitto_msg_origin{
+	mosq_mo_client = 0,
+	mosq_mo_broker = 1
+};
+
 struct mosquitto__auth_plugin{
 	void *lib;
 	void *user_data;
@ -367,6 +373,7 @@ struct mosquitto_msg_store{
 	uint16_t mid;
 	uint8_t qos;
 	bool retain;
+	uint8_t origin;
 };

 struct mosquitto_client_msg{
@ -608,7 +615,7 @@ int db__message_write(struct mosquitto_db *db, struct mosquitto *context);
 void db__message_dequeue_first(struct mosquitto *context, struct mosquitto_msg_data *msg_data);
 int db__messages_delete(struct mosquitto_db *db, struct mosquitto *context);
 int db__messages_easy_queue(struct mosquitto_db *db, struct mosquitto *context, const char *topic, int qos, uint32_t payloadlen, const void *payload, int retain, uint32_t message_expiry_interval, mosquitto_property **properties);
-int db__message_store(struct mosquitto_db *db, const struct mosquitto *source, uint16_t source_mid, char *topic, int qos, uint32_t payloadlen, mosquitto__payload_uhpa *payload, int retain, struct mosquitto_msg_store **stored, uint32_t message_expiry_interval, mosquitto_property *properties, dbid_t store_id);
+int db__message_store(struct mosquitto_db *db, const struct mosquitto *source, uint16_t source_mid, char *topic, int qos, uint32_t payloadlen, mosquitto__payload_uhpa *payload, int retain, struct mosquitto_msg_store **stored, uint32_t message_expiry_interval, mosquitto_property *properties, dbid_t store_id, enum mosquitto_msg_origin origin);
 int db__message_store_find(struct mosquitto *context, uint16_t mid, struct mosquitto_msg_store **stored);
 void db__msg_store_add(struct mosquitto_db *db, struct mosquitto_msg_store *store);
 void db__msg_store_remove(struct mosquitto_db *db, struct mosquitto_msg_store *store);
@ -667,9 +674,9 @@ void bridge__packet_cleanup(struct mosquitto *context);
 /* ============================================================
 * Property related functions
 * ============================================================ */
-int property__process_connect(struct mosquitto *context, mosquitto_property *props);
-int property__process_will(struct mosquitto *context, struct mosquitto_message_all *msg, mosquitto_property *props);
-int property__process_disconnect(struct mosquitto *context, mosquitto_property *props);
+int property__process_connect(struct mosquitto *context, mosquitto_property **props);
+int property__process_will(struct mosquitto *context, struct mosquitto_message_all *msg, mosquitto_property **props);
+int property__process_disconnect(struct mosquitto *context, mosquitto_property **props);

 /* ============================================================
 * Security related functions
--- a/src/net.c
+++ b/src/net.c
@ -412,13 +412,13 @@ int net__socket_listen(struct mosquitto__listener *listener)
 	struct addrinfo hints;
 	struct addrinfo *ainfo, *rp;
 	char service[10];
+	int rc;
 #ifndef WIN32
 	int ss_opt = 1;
 #else
 	char ss_opt = 1;
 #endif
 #ifdef WITH_TLS
-	int rc;
 	X509_STORE *store;
 	X509_LOOKUP *lookup;
 	ENGINE *engine = NULL;
--- a/src/persist_read.c
+++ b/src/persist_read.c
@ -283,7 +283,8 @@ static int persist__msg_store_chunk_restore(struct mosquitto_db *db, FILE *db_fp

 	rc = db__message_store(db, &chunk.source, chunk.F.source_mid,
 			chunk.topic, chunk.F.qos, chunk.F.payloadlen,
-			&chunk.payload, chunk.F.retain, &stored, message_expiry_interval, chunk.properties, chunk.F.store_id);
+			&chunk.payload, chunk.F.retain, &stored, message_expiry_interval,
+			chunk.properties, chunk.F.store_id, mosq_mo_client);

 	mosquitto__free(chunk.source.id);
 	mosquitto__free(chunk.source.username);
--- a/src/property_broker.c
+++ b/src/property_broker.c
@ -26,11 +26,11 @@ Contributors:

 /* Process the incoming properties, we should be able to assume that only valid
 * properties for CONNECT are present here. */
-int property__process_connect(struct mosquitto *context, mosquitto_property *props)
+int property__process_connect(struct mosquitto *context, mosquitto_property **props)
 {
 	mosquitto_property *p;

-	p = props;
+	p = *props;

 	while(p){
 		if(p->identifier == MQTT_PROP_SESSION_EXPIRY_INTERVAL){
@ -55,12 +55,12 @@ int property__process_connect(struct mosquitto *context, mosquitto_property *pro
 }


-int property__process_will(struct mosquitto *context, struct mosquitto_message_all *msg, mosquitto_property *props)
+int property__process_will(struct mosquitto *context, struct mosquitto_message_all *msg, mosquitto_property **props)
 {
 	mosquitto_property *p, *p_prev;
 	mosquitto_property *msg_properties, *msg_properties_last;

-	p = props;
+	p = *props;
 	p_prev = NULL;
 	msg_properties = NULL;
 	msg_properties_last = NULL;
@ -70,6 +70,7 @@ int property__process_will(struct mosquitto *context, struct mosquitto_message_a
 			case MQTT_PROP_CORRELATION_DATA:
 			case MQTT_PROP_PAYLOAD_FORMAT_INDICATOR:
 			case MQTT_PROP_RESPONSE_TOPIC:
+			case MQTT_PROP_USER_PROPERTY:
 				if(msg_properties){
 					msg_properties_last->next = p;
 					msg_properties_last = p;
@ -81,8 +82,8 @@ int property__process_will(struct mosquitto *context, struct mosquitto_message_a
 					p_prev->next = p->next;
 					p = p_prev->next;
 				}else{
-					props = p->next;
-					p = props;
+					*props = p->next;
+					p = *props;
 				}
 				msg_properties_last->next = NULL;
 				break;
@ -112,11 +113,11 @@ int property__process_will(struct mosquitto *context, struct mosquitto_message_a

 /* Process the incoming properties, we should be able to assume that only valid
 * properties for DISCONNECT are present here. */
-int property__process_disconnect(struct mosquitto *context, mosquitto_property *props)
+int property__process_disconnect(struct mosquitto *context, mosquitto_property **props)
 {
 	mosquitto_property *p;

-	p = props;
+	p = *props;

 	while(p){
 		if(p->identifier == MQTT_PROP_SESSION_EXPIRY_INTERVAL){
--- a/src/subs.c
+++ b/src/subs.c
@ -1000,7 +1000,7 @@ static int retain__process(struct mosquitto_db *db, struct mosquitto__subhier *b
 	}

 	/* Check for original source access */
-	if(db->config->check_retain_source && retained->source_id){
+	if(db->config->check_retain_source && retained->origin != mosq_mo_broker && retained->source_id){
 		struct mosquitto retain_ctxt;
 		memset(&retain_ctxt, 0, sizeof(struct mosquitto));

--- a/src/sys_tree.c
+++ b/src/sys_tree.c
@ -52,7 +52,7 @@ void sys_tree__init(struct mosquitto_db *db)

 	/* Set static $SYS messages */
 	snprintf(buf, 64, "mosquitto version %s", VERSION);
-	db__messages_easy_queue(db, NULL, "$SYS/broker/version", SYS_TREE_QOS, strlen(buf), buf, 1, 60, NULL);
+	db__messages_easy_queue(db, NULL, "$SYS/broker/version", SYS_TREE_QOS, strlen(buf), buf, 1, 0, NULL);
 }

 static void sys_tree__update_clients(struct mosquitto_db *db, char *buf)
--- a/test/broker/07-will-properties.py
+++ b/test/broker/07-will-properties.py
@ -0,0 +1,93 @@
+#!/usr/bin/env python3
+
+# Test for bug #1244. This occurs if a V5 will message is used where the first
+# Will property is one of: content-type, payload-format-indicator,
+# response-topic. These are the properties that are attached to the will for
+# later use, as opposed to e.g.  will-delay-interval which is a value which is
+# read immediately and not passed
+
+from mosq_test_helper import *
+
+def do_test(will_props, recvd_props):
+    rc = 1
+    keepalive = 60
+
+    mid = 1
+    connect1_packet = mosq_test.gen_connect("will-helper", keepalive=keepalive, proto_ver=5)
+    connack1_packet = mosq_test.gen_connack(rc=0, proto_ver=5)
+
+    subscribe1_packet = mosq_test.gen_subscribe(mid, "will/test", 0, proto_ver=5)
+    suback1_packet = mosq_test.gen_suback(mid, 0, proto_ver=5)
+
+    connect2_packet = mosq_test.gen_connect("will-test", keepalive=keepalive, proto_ver=5, will_topic="will/test", will_payload=b"will payload", will_properties=will_props)
+    connack2_packet = mosq_test.gen_connack(rc=0, proto_ver=5)
+
+    publish_packet = mosq_test.gen_publish("will/test", qos=0, payload="will payload", proto_ver=5, properties=recvd_props)
+
+    port = mosq_test.get_port()
+    broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port)
+
+    try:
+        sock1 = mosq_test.do_client_connect(connect1_packet, connack1_packet, timeout=30, port=port)
+        mosq_test.do_send_receive(sock1, subscribe1_packet, suback1_packet, "suback")
+
+        sock2 = mosq_test.do_client_connect(connect2_packet, connack2_packet, timeout=30, port=port)
+        sock2.close()
+
+        if mosq_test.expect_packet(sock1, "publish", publish_packet):
+            rc = 0
+
+        sock1.close()
+    finally:
+        broker.terminate()
+        broker.wait()
+        (stdo, stde) = broker.communicate()
+        if rc:
+            print(stde.decode('utf-8'))
+            exit(rc)
+
+
+# Single test property
+will_props = mqtt5_props.gen_string_prop(mqtt5_props.PROP_RESPONSE_TOPIC, "response/topic")
+#do_test(will_props, will_props)
+
+# Multiple test properties
+will_props = mqtt5_props.gen_string_prop(mqtt5_props.PROP_RESPONSE_TOPIC, "response/topic")
+will_props += mqtt5_props.gen_byte_prop(mqtt5_props.PROP_PAYLOAD_FORMAT_INDICATOR, 0)
+#do_test(will_props, will_props)
+
+# Multiple test properties, with property that is removed
+will_props = mqtt5_props.gen_string_prop(mqtt5_props.PROP_RESPONSE_TOPIC, "response/topic")
+will_props += mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_WILL_DELAY_INTERVAL, 0)
+will_props += mqtt5_props.gen_byte_prop(mqtt5_props.PROP_PAYLOAD_FORMAT_INDICATOR, 0)
+
+recv_props = mqtt5_props.gen_string_prop(mqtt5_props.PROP_RESPONSE_TOPIC, "response/topic")
+recv_props += mqtt5_props.gen_byte_prop(mqtt5_props.PROP_PAYLOAD_FORMAT_INDICATOR, 0)
+#do_test(will_props, recv_props)
+
+# Multiple test properties, with property that is removed *first*
+will_props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_WILL_DELAY_INTERVAL, 0)
+will_props += mqtt5_props.gen_string_prop(mqtt5_props.PROP_RESPONSE_TOPIC, "response/topic")
+will_props += mqtt5_props.gen_string_prop(mqtt5_props.PROP_CORRELATION_DATA, "data")
+
+recv_props = mqtt5_props.gen_string_prop(mqtt5_props.PROP_RESPONSE_TOPIC, "response/topic")
+recv_props += mqtt5_props.gen_string_prop(mqtt5_props.PROP_CORRELATION_DATA, "data")
+#do_test(will_props, recv_props)
+
+# All properties,  plus multiple user properties (excluding
+# message-expiry-interval, for ease of testing reasons)
+will_props = mqtt5_props.gen_string_pair_prop(mqtt5_props.PROP_USER_PROPERTY, "key1", "value1")
+will_props += mqtt5_props.gen_string_prop(mqtt5_props.PROP_RESPONSE_TOPIC, "response/topic")
+will_props += mqtt5_props.gen_string_prop(mqtt5_props.PROP_CORRELATION_DATA, "data")
+will_props += mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_WILL_DELAY_INTERVAL, 0)
+will_props += mqtt5_props.gen_byte_prop(mqtt5_props.PROP_PAYLOAD_FORMAT_INDICATOR, 1)
+will_props += mqtt5_props.gen_string_prop(mqtt5_props.PROP_CONTENT_TYPE, "application/test")
+will_props += mqtt5_props.gen_string_pair_prop(mqtt5_props.PROP_USER_PROPERTY, "key2", "value2")
+
+recv_props = mqtt5_props.gen_string_pair_prop(mqtt5_props.PROP_USER_PROPERTY, "key1", "value1")
+recv_props += mqtt5_props.gen_string_prop(mqtt5_props.PROP_RESPONSE_TOPIC, "response/topic")
+recv_props += mqtt5_props.gen_string_prop(mqtt5_props.PROP_CORRELATION_DATA, "data")
+recv_props += mqtt5_props.gen_byte_prop(mqtt5_props.PROP_PAYLOAD_FORMAT_INDICATOR, 1)
+recv_props += mqtt5_props.gen_string_prop(mqtt5_props.PROP_CONTENT_TYPE, "application/test")
+recv_props += mqtt5_props.gen_string_pair_prop(mqtt5_props.PROP_USER_PROPERTY, "key2", "value2")
+do_test(will_props, recv_props)
--- a/test/broker/Makefile
+++ b/test/broker/Makefile
@ -141,6 +141,7 @@ endif
 	./07-will-no-flag.py
 	./07-will-null-topic.py
 	./07-will-null.py
+	./07-will-properties.py
 	./07-will-qos0.py

 08 :
--- a/test/broker/test.py
+++ b/test/broker/test.py
@ -115,6 +115,7 @@ tests = [
    (1, './07-will-no-flag.py'),
    (1, './07-will-null-topic.py'),
    (1, './07-will-null.py'),
+    (1, './07-will-properties.py'),
    (1, './07-will-qos0.py'),

    (2, './08-ssl-bridge.py'),
--- a/test/unit/persist_read_stubs.c
+++ b/test/unit/persist_read_stubs.c
@ -28,7 +28,7 @@ struct mosquitto *context__init(struct mosquitto_db *db, mosq_sock_t sock)
 	return m;
 }

-int db__message_store(struct mosquitto_db *db, const struct mosquitto *source, uint16_t source_mid, char *topic, int qos, uint32_t payloadlen, mosquitto__payload_uhpa *payload, int retain, struct mosquitto_msg_store **stored, uint32_t message_expiry_interval, mosquitto_property *properties, dbid_t store_id)
+int db__message_store(struct mosquitto_db *db, const struct mosquitto *source, uint16_t source_mid, char *topic, int qos, uint32_t payloadlen, mosquitto__payload_uhpa *payload, int retain, struct mosquitto_msg_store **stored, uint32_t message_expiry_interval, mosquitto_property *properties, dbid_t store_id, enum mosquitto_msg_origin origin)
 {
    struct mosquitto_msg_store *temp = NULL;
    int rc = MOSQ_ERR_SUCCESS;
--- a/www/pages/download.md
+++ b/www/pages/download.md
@ -1,7 +1,7 @@
 <!--
 .. title: Download
 .. slug: download
-.. date: 2019-04-26 16:41:00 UTC+1
+.. date: 2019-04-30 13:12:00 UTC+1
 .. tags: tag
 .. category: category
 .. link: link
@ -11,7 +11,7 @@

 # Source

-* [mosquitto-1.6.1.tar.gz](https://mosquitto.org/files/source/mosquitto-1.6.1.tar.gz) (319kB) ([GPG signature](https://mosquitto.org/files/source/mosquitto-1.6.1.tar.gz.asc))
+* [mosquitto-1.6.2.tar.gz](https://mosquitto.org/files/source/mosquitto-1.6.2.tar.gz) (319kB) ([GPG signature](https://mosquitto.org/files/source/mosquitto-1.6.2.tar.gz.asc))
 * [Git source code repository](https://github.com/eclipse/mosquitto) (github.com)

 Older downloads are available at [https://mosquitto.org/files/](../files/)
@ -24,8 +24,8 @@ distributions.

 ## Windows

-* [mosquitto-1.6.1-install-windows-x64.exe](https://mosquitto.org/files/binary/win64/mosquitto-1.6.1-install-windows-x64.exe) (~360 kB) (64-bit build, Windows Vista and up, built with Visual Studio Community 2017)
-* [mosquitto-1.6.1-install-windows-x32.exe](https://mosquitto.org/files/binary/win32/mosquitto-1.6.1-install-windows-x86.exe) (~360 kB) (32-bit build, Windows Vista and up, built with Visual Studio Community 2017)
+* [mosquitto-1.6.2-install-windows-x64.exe](https://mosquitto.org/files/binary/win64/mosquitto-1.6.2-install-windows-x64.exe) (~360 kB) (64-bit build, Windows Vista and up, built with Visual Studio Community 2017)
+* [mosquitto-1.6.2-install-windows-x32.exe](https://mosquitto.org/files/binary/win32/mosquitto-1.6.2-install-windows-x86.exe) (~360 kB) (32-bit build, Windows Vista and up, built with Visual Studio Community 2017)

 See also readme-windows.txt after installing.

--- a/www/pages/security.md
+++ b/www/pages/security.md
@ -19,6 +19,8 @@ follow the steps on [Eclipse Security] page to report it.
 Listed with most recent first. Further information on security related issues
 can be found in the [security category].

+* April 2019: No CVE assigned. Affecting versions **1.6** and **1.6.1**,
+  fixed in **1.6.2**. More details at [version-162-released].
 * December 2018: [CVE-2018-20145]. Affecting versions **1.5** to **1.5.4**
  inclusive, fixed in **1.5.5.**. More details at [version-155-released].
 * November 2018: No CVE assigned. Affecting versions **1.4** to **1.5.3**
@ -45,6 +47,7 @@ can be found in the [security category].
  inclusive, fixed in **1.4.12**. More details at
  [security-advisory-cve-2017-7650].

+[version-162-released]: /2019/04/version-1-6-2-released/
 [version-155-released]: /2018/11/version-155-released/
 [version-154-released]: /2018/11/version-154-released/
 [security-advisory-cve-2018-12543]: /2018/09/security-advisory-cve-2018-12543/
--- a/www/posts/2019/04/version-1-6-2-released.md
+++ b/www/posts/2019/04/version-1-6-2-released.md
@ -0,0 +1,46 @@
+<!--
+.. title: Version 1.6.2 released
+.. slug: version-1-6-2-released
+.. date: 2019-04-30 13:07:00 UTC+1
+.. tags: Releases
+.. category:
+.. link:
+.. description:
+.. type: text
+-->
+
+This is a security and bugfix release.
+
+## Security
+
+If a client connects using MQTT v5, will a Will message that has MQTT v5
+properties attached, and the very first Will property is one of `content-type`,
+`correlation-data`, `payload-format-indicator`, or `response-topic`, then at
+the point the client disconnects, the broker will attempt to read from freed
+memory, resulting in a possible crash.
+
+
+## Broker
+- Fix memory access after free, leading to possible crash, when v5 client with
+  Will message disconnects, where the Will message has as its first property
+  one of `content-type`, `correlation-data`, `payload-format-indicator`, or
+  `response-topic`.  Closes [#1244].
+- Fix build for `WITH_TLS=no`. Closes [#1250].
+- Fix Will message not allowing `user-property` properties.
+- Fix broker originated messages (e.g. `$SYS/broker/version`) not being
+  published when `check_retain_source` set to true. Closes [#1245].
+- Fix `$SYS/broker/version` being incorrectly expired after 60 seconds.
+  Closes [#1245].
+
+## Library
+- Fix crash after client has been unable to connect to a broker. This occurs
+  when the client is exiting and is part of the final library cleanup routine.
+  Closes [#1246].
+
+## Clients
+- Fix `-L` url parsing. Closes [#1248].
+
+[#1244]: https://github.com/eclipse/mosquitto/issues/1244
+[#1245]: https://github.com/eclipse/mosquitto/issues/1245
+[#1246]: https://github.com/eclipse/mosquitto/issues/1246
+[#1250]: https://github.com/eclipse/mosquitto/issues/1250