From c8af7cdd2740ecf89e927c1a26437e4c29d5ae6e Mon Sep 17 00:00:00 2001 From: Deomid Ryabkov Date: Wed, 6 Sep 2017 18:25:27 +0100 Subject: [PATCH] Check for int overflow when parsing WS frames PUBLISHED_FROM=b7325b38e881455df703b0b628c41931565ccb33 --- mongoose.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/mongoose.c b/mongoose.c index 5e8193a4..c573e7aa 100644 --- a/mongoose.c +++ b/mongoose.c @@ -9204,7 +9204,13 @@ static int mg_deliver_websocket_data(struct mg_connection *nc) { } frame_len = header_len + data_len; - ok = frame_len > 0 && frame_len <= buf_len; + ok = (frame_len > 0 && frame_len <= buf_len); + + /* Check for overflow */ + if (frame_len < header_len || frame_len < data_len) { + ok = 0; + nc->flags |= MG_F_CLOSE_IMMEDIATELY; + } if (ok) { struct websocket_message wsm;