Eclipse Mosquitto SUBSCRIBE Topic Length Stack Buffer Overflow

A stack based buffer overflow exists in Eclipse Mosquitto 1.5 to 1.6.5 due to stack area being overrun by the recursive function retain search. A remote attacker may crash the server by sending a SUBSCRIBE packet with a topic name of variable length consisting of / characters. The exact number of characters depends on the stack size and how much of the stack space is filled at runtime.