From cdc439bc38570048541b2ac6b9c326da87bf4a0a Mon Sep 17 00:00:00 2001 From: robert Date: Fri, 9 May 2025 04:56:31 -0400 Subject: [PATCH] Websocket offset validation enhancement --- mongoose.c | 2 +- src/ws.c | 2 +- test/unit_test.c | 1 + 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/mongoose.c b/mongoose.c index a1362b62..bf6546b8 100644 --- a/mongoose.c +++ b/mongoose.c @@ -19719,7 +19719,7 @@ static void mg_ws_cb(struct mg_connection *c, int ev, void *ev_data) { // Remove non-fragmented frame if (final && op) mg_iobuf_del(&c->recv, ofs, len); // Last chunk of the fragmented frame - if (final && !op) { + if (final && !op && (ofs > 0)) { m.flags = c->recv.buf[0]; m.data = mg_str_n((char *) &c->recv.buf[1], (size_t) (ofs - 1)); mg_call(c, MG_EV_WS_MSG, &m); diff --git a/src/ws.c b/src/ws.c index e3bc0281..9cef50de 100644 --- a/src/ws.c +++ b/src/ws.c @@ -219,7 +219,7 @@ static void mg_ws_cb(struct mg_connection *c, int ev, void *ev_data) { // Remove non-fragmented frame if (final && op) mg_iobuf_del(&c->recv, ofs, len); // Last chunk of the fragmented frame - if (final && !op) { + if (final && !op && (ofs > 0)) { m.flags = c->recv.buf[0]; m.data = mg_str_n((char *) &c->recv.buf[1], (size_t) (ofs - 1)); mg_call(c, MG_EV_WS_MSG, &m); diff --git a/test/unit_test.c b/test/unit_test.c index 5a465246..1aa3cc9b 100644 --- a/test/unit_test.c +++ b/test/unit_test.c @@ -811,6 +811,7 @@ static void wcb(struct mg_connection *c, int ev, void *ev_data) { struct mg_http_message *hm = (struct mg_http_message *) ev_data; struct mg_str *wsproto = mg_http_get_header(hm, "Sec-WebSocket-Protocol"); ASSERT(wsproto != NULL); + mg_ws_send(c, "hello", 0, 0); mg_ws_printf(c, WEBSOCKET_OP_BINARY, "%.3s", "boo!!!!"); mg_ws_printf(c, WEBSOCKET_OP_BINARY, "%s", "foobar"); mg_ws_send(c, "", 0, WEBSOCKET_OP_PING);