From 7f7c1ff6c2d248fb40c066139e5f245e74ca52c3 Mon Sep 17 00:00:00 2001 From: "Sergio R. Caprile" Date: Tue, 9 Jul 2024 14:55:47 -0300 Subject: [PATCH] handle possible memory trashes on mg_send() and mg_iobuf_add() failures --- mongoose.c | 16 ++++++++-------- src/ws.c | 16 ++++++++-------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/mongoose.c b/mongoose.c index f38d37b9..17d64f86 100644 --- a/mongoose.c +++ b/mongoose.c @@ -16603,9 +16603,9 @@ size_t mg_ws_send(struct mg_connection *c, const void *buf, size_t len, int op) { uint8_t header[14]; size_t header_len = mkhdr(len, op, c->is_client, header); - mg_send(c, header, header_len); + if (!mg_send(c, header, header_len)) return 0; + if (!mg_send(c, buf, len)) return header_len; MG_VERBOSE(("WS out: %d [%.*s]", (int) len, (int) len, buf)); - mg_send(c, buf, len); mg_ws_mask(c, len); return header_len + len; } @@ -16757,12 +16757,12 @@ size_t mg_ws_wrap(struct mg_connection *c, size_t len, int op) { size_t header_len = mkhdr(len, op, c->is_client, header); // NOTE: order of operations is important! - mg_iobuf_add(&c->send, c->send.len, NULL, header_len); - p = &c->send.buf[c->send.len - len]; // p points to data - memmove(p, p - header_len, len); // Shift data - memcpy(p - header_len, header, header_len); // Prepend header - mg_ws_mask(c, len); // Mask data - + if (mg_iobuf_add(&c->send, c->send.len, NULL, header_len) != 0) { + p = &c->send.buf[c->send.len - len]; // p points to data + memmove(p, p - header_len, len); // Shift data + memcpy(p - header_len, header, header_len); // Prepend header + mg_ws_mask(c, len); // Mask data + } return c->send.len; } diff --git a/src/ws.c b/src/ws.c index a3ed5c82..e3bc0281 100644 --- a/src/ws.c +++ b/src/ws.c @@ -133,9 +133,9 @@ size_t mg_ws_send(struct mg_connection *c, const void *buf, size_t len, int op) { uint8_t header[14]; size_t header_len = mkhdr(len, op, c->is_client, header); - mg_send(c, header, header_len); + if (!mg_send(c, header, header_len)) return 0; + if (!mg_send(c, buf, len)) return header_len; MG_VERBOSE(("WS out: %d [%.*s]", (int) len, (int) len, buf)); - mg_send(c, buf, len); mg_ws_mask(c, len); return header_len + len; } @@ -287,11 +287,11 @@ size_t mg_ws_wrap(struct mg_connection *c, size_t len, int op) { size_t header_len = mkhdr(len, op, c->is_client, header); // NOTE: order of operations is important! - mg_iobuf_add(&c->send, c->send.len, NULL, header_len); - p = &c->send.buf[c->send.len - len]; // p points to data - memmove(p, p - header_len, len); // Shift data - memcpy(p - header_len, header, header_len); // Prepend header - mg_ws_mask(c, len); // Mask data - + if (mg_iobuf_add(&c->send, c->send.len, NULL, header_len) != 0) { + p = &c->send.buf[c->send.len - len]; // p points to data + memmove(p, p - header_len, len); // Shift data + memcpy(p - header_len, header, header_len); // Prepend header + mg_ws_mask(c, len); // Mask data + } return c->send.len; }