MqttDecode_FixedHeader: bound VBI by rx_buf_len - 1

[jmestwa-coder]

MqttDecode_FixedHeader passes rx_buf_len to MqttDecode_Vbi, but header->len starts at offset 1 (after type_flags), so the VBI bound was one byte too large. With rx_buf_len == 2 and the lone length byte's continuation bit set (0x80), the do/while in MqttDecode_Vbi reads rx_buf[2] past the caller-supplied bound.

Page-guard reproducer (rx_buf = base + page - 2, rx_buf[1] = 0x80, adjacent PROT_NONE):

$ ./repro                       # master
[process terminated: SIGBUS]    # exit 138
$ ./repro                       # patched
rc=-2                           # MQTT_CODE_ERROR_OUT_OF_BUFFER

Reachable through any MqttDecode_* callee that forwards rx_buf_len from a public API.

[wolfSSL-Bot]

Can one of the admins verify this patch?