MQTT: Missing upper bound on incoming Remaining Length allows server-controlled long wait

Curl's MQTT implementation accepts any valid Remaining Length advertised by the server without an explicit upper bound (beyond the MQTT spec maximum of 268,435,455 bytes). A malicious server can send a PUBLISH packet claiming this maximum size but provide only minimal payload, causing curl to wait …

data->req.size = remlen;
mq->npacket = remlen;