A heap buffer overflow vulnerability exists in NanoMQ 0.17.2. The vulnerability can be triggered by calling the function nni_msg_get_pub_pid() in the file message.c. An attacker could exploit this vulnerability to cause a denial of service attack.
**Describe the bug**
We (School of Cyber Science and Technology, Shandong University) found that NanoMQ can cause  buffer overflow when it processes malformed PUBLISH messages.

**Expected behavior**

If Asan is enabled at compile time, the NanoMQ crashes and displays ASAN information.
![image](https://user-images.githubusercontent.com/44093631/231410694-a3e662c2-ffb9-480f-86ab-66744864b4a5.png)


**Actual Behavior**
Describe what occurred.

**To Reproduce**
From a vulnerability disclosure point of view, I will email(jaylin@emqx.io) the POC to the developer for validation since it's possible to achieve at least a DoS pretty easily.

** Environment Details **
 - NanoMQ version：master branch version commit #a72347c （As it is also the current HEAD version of [gitee](https://gitee.com/emqx/nanomq?_from=gitee_search) ）
 - Operating system and version：Ubuntu 20.04
 - Compiler and language used：gcc 9.4.0 clang 10.0.0
 - testing scenario

1. start nanomq with ./nanomq start
2. Send the packet：nc 127.0.0.1 1883 < ./poc.raw
3. NanoMQ crashes

[Security]: Vulnerability that are  unecessary to be fixed
This is a GitHub Issue
repo:nanomq
owner:emqx
Title : [Security]: Vulnerability that are  unecessary to be fixed
Issue date:

--- start body ---
**Describe the bug**
We (School of Cyber Science and Technology, Shandong University) found that NanoMQ can cause  buffer overflow when it processes malformed PUBLISH messages.

**Expected behavior**

If Asan is enabled at compile time, the NanoMQ crashes and displays ASAN information.
![image](https://user-images.githubusercontent.com/44093631/231410694-a3e662c2-ffb9-480f-86ab-66744864b4a5.png)


**Actual Behavior**
Describe what occurred.

**To Reproduce**
From a vulnerability disclosure point of view, I will email(jaylin@emqx.io) the POC to the developer for validation since it's possible to achieve at least a DoS pretty easily.

** Environment Details **
 - NanoMQ version：master branch version commit #a72347c （As it is also the current HEAD version of [gitee](https://gitee.com/emqx/nanomq?_from=gitee_search) ）
 - Operating system and version：Ubuntu 20.04
 - Compiler and language used：gcc 9.4.0 clang 10.0.0
 - testing scenario

1. start nanomq with ./nanomq start
2. Send the packet：nc 127.0.0.1 1883 < ./poc.raw
3. NanoMQ crashes

--- end body ---
