A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack by causing the program to consume all available memory resources.
**Describe the bug**
Our team (School of Cyber Science and Technology, Shandong University)have found the a potential issue in the current version of nanomq,it may cause heap-use-after-free when it handles the publish messages 

**Expected behavior**
We use ASAN to compile the target server, and when we send a large number of malformed data packets to it, it may crash and output the following information ：
![image](https://user-images.githubusercontent.com/92987321/232107702-eb628585-c956-48fb-817f-e72c71c3edf4.png)
the Call stack information is：
![image](https://user-images.githubusercontent.com/92987321/232110281-6445c4af-0e44-4b04-9f50-9682cef62c28.png)


**Actual Behavior**
Describe what occurred.

**To Reproduce**
we will provide the POC below to the developer for validation:
[heap-use-after-free-poc.zip](https://github.com/emqx/nanomq/files/11235468/heap-use-after-free-poc.zip)


** Environment Details **
 - NanoMQ version master branch version commit #8c54cd7
 - Operating system and version Ubuntu 20.04
 - Compiler and language used  gcc 9.4.0 clang 10.0.0
 - testing scenario

start nanomq with ./nanomq start
Send the packet：nc 127.0.0.1 1883 < heap-use-after-free-poc（Repeat multiple times）
util cause NanoMQ crashes

**Additional context**
To trigger the issue, it is necessary to continuously replay the poc multiple times until nanomq crashes,it may need 2 - 15 times

[Security]: wrong protocol name & data racing
This is a GitHub Issue
repo:nanomq
owner:emqx
Title : [Security]: wrong protocol name & data racing
Issue date:

--- start body ---
**Describe the bug**
Our team (School of Cyber Science and Technology, Shandong University)have found the a potential issue in the current version of nanomq,it may cause heap-use-after-free when it handles the publish messages 

**Expected behavior**
We use ASAN to compile the target server, and when we send a large number of malformed data packets to it, it may crash and output the following information ：
![image](https://user-images.githubusercontent.com/92987321/232107702-eb628585-c956-48fb-817f-e72c71c3edf4.png)
the Call stack information is：
![image](https://user-images.githubusercontent.com/92987321/232110281-6445c4af-0e44-4b04-9f50-9682cef62c28.png)


**Actual Behavior**
Describe what occurred.

**To Reproduce**
we will provide the POC below to the developer for validation:
[heap-use-after-free-poc.zip](https://github.com/emqx/nanomq/files/11235468/heap-use-after-free-poc.zip)


** Environment Details **
 - NanoMQ version master branch version commit #8c54cd7
 - Operating system and version Ubuntu 20.04
 - Compiler and language used  gcc 9.4.0 clang 10.0.0
 - testing scenario

start nanomq with ./nanomq start
Send the packet：nc 127.0.0.1 1883 < heap-use-after-free-poc（Repeat multiple times）
util cause NanoMQ crashes

**Additional context**
To trigger the issue, it is necessary to continuously replay the poc multiple times until nanomq crashes,it may need 2 - 15 times

--- end body ---

A potential heap-use-after-free vulnerability in NanoMQ allows attackers to crash the server by sending a large number of malformed data packets. This can lead to memory corruption and unexpected behavior, which is a significant security risk.