From 39a34784297d28297d7d60925ef7363f052118b0 Mon Sep 17 00:00:00 2001
From: "Sergio R. Caprile" <scaprile@gmail.com>
Date: Wed, 2 Sep 2026 16:28:35 -0300
Subject: [PATCH] fix ws data length handling

---
 mongoose.c | 10 +++++-----
 src/ws.c   | 10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/mongoose.c b/mongoose.c
index cd763321..a94c3941 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -26539,14 +26539,14 @@ static size_t ws_process(uint8_t *buf, size_t len, struct ws_msg *msg) {
       msg->header_len = 4 + mask_len;
       msg->data_len = (((size_t) buf[2]) << 8) | buf[3];
     } else if (len >= 10 + mask_len) {
+      uint64_t data_len = ((uint64_t) be32(buf + 2) << 32) + be32(buf + 6);
+      // Sanity check, and integer overflow protection for the boundary check below
+      // data_len should not be larger than 1 GB
+      if (data_len > 1024 * 1024 * 1024) return 0;
+      msg->data_len = (size_t) data_len;
       msg->header_len = 10 + mask_len;
-      msg->data_len =
-          (size_t) (((uint64_t) be32(buf + 2) << 32) + be32(buf + 6));
     }
   }
-  // Sanity check, and integer overflow protection for the boundary check below
-  // data_len should not be larger than 1 Gb
-  if (msg->data_len > 1024 * 1024 * 1024) return 0;
   if (msg->header_len + msg->data_len > len) return 0;
   if (mask_len > 0) {
     uint8_t *p = buf + msg->header_len, *m = p - mask_len;
diff --git a/src/ws.c b/src/ws.c
index c4ab6b9a..8a1a37d8 100644
--- a/src/ws.c
+++ b/src/ws.c
@@ -77,14 +77,14 @@ static size_t ws_process(uint8_t *buf, size_t len, struct ws_msg *msg) {
       msg->header_len = 4 + mask_len;
       msg->data_len = (((size_t) buf[2]) << 8) | buf[3];
     } else if (len >= 10 + mask_len) {
+      uint64_t data_len = ((uint64_t) be32(buf + 2) << 32) + be32(buf + 6);
+      // Sanity check, and integer overflow protection for the boundary check below
+      // data_len should not be larger than 1 GB
+      if (data_len > 1024 * 1024 * 1024) return 0;
+      msg->data_len = (size_t) data_len;
       msg->header_len = 10 + mask_len;
-      msg->data_len =
-          (size_t) (((uint64_t) be32(buf + 2) << 32) + be32(buf + 6));
     }
   }
-  // Sanity check, and integer overflow protection for the boundary check below
-  // data_len should not be larger than 1 Gb
-  if (msg->data_len > 1024 * 1024 * 1024) return 0;
   if (msg->header_len + msg->data_len > len) return 0;
   if (mask_len > 0) {
     uint8_t *p = buf + msg->header_len, *m = p - mask_len;