Bound each WebSocket fragment by what is left of the limit

Every continuation frame could be as long as the whole message limit,
and the total was checked only after appending it, so a fragmented
message could take about twice the limit. Read each fragment against
what is left, with room for a control frame between them.
This commit is contained in:
yhirose committed 2026-10-16 16:39:00 -04:00
1 parent 672255619b
commit f5e11024da
2 files changed
+74 -4

No files matched your search

+11 -4
View File
@@ -22879,10 +22879,17 @@ inline ReadResult WebSocket::read(std::string &msg) {
// already in `msg` and read() has no way to resume it, so it is a
// failure like any other. Timeouts are only ever seen on a message
// boundary.
if (impl::read_websocket_frame(
strm_, cont_opcode, cont_payload, cont_fin, is_server_,
CPPHTTPLIB_WEBSOCKET_MAX_PAYLOAD_LENGTH) !=
impl::FrameRead::Ok) {
// Only what is left of the limit, but room for a control frame,
// which may come between the fragments.
auto max_len =
CPPHTTPLIB_WEBSOCKET_MAX_PAYLOAD_LENGTH == 0
? size_t(0)
: (std::max)(size_t(125),
CPPHTTPLIB_WEBSOCKET_MAX_PAYLOAD_LENGTH -
msg.size());
if (impl::read_websocket_frame(strm_, cont_opcode, cont_payload,
cont_fin, is_server_,
max_len) != impl::FrameRead::Ok) {
closed_ = true;
return Fail;
}