wt/mongoose
1
0 Fork 0
mirror of https://github.com/cesanta/mongoose.git synced 2026-10-18 10:59:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

WS frame len sanity check

Browse Source
This commit is contained in:
Sergey Lyubka committed 2021-09-14 10:26:03 +01:00
1 parent 6316609a5f
commit f37e5ecc38
2 files changed
+6
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

mongoose.c
+3
View File
@@ -4547,6 +4547,9 @@ static size_t ws_process(uint8_t *buf, size_t len, struct ws_msg *msg) {
mg_ntohl(*(uint32_t *) &buf[6]);
}
}
// Sanity check, and integer overflow protection for the boundary check below
// data_len should not be larger than 1 Gb
// if (msg->data_len > 1024 * 1024 * 1024) return 0;
if (msg->header_len + msg->data_len > len) return 0;
if (mask_len > 0) {
uint8_t *p = buf + msg->header_len, *m = p - mask_len;
src/ws.c
+3
View File
@@ -64,6 +64,9 @@ static size_t ws_process(uint8_t *buf, size_t len, struct ws_msg *msg) {
mg_ntohl(*(uint32_t *) &buf[6]);
}
}
// Sanity check, and integer overflow protection for the boundary check below
// data_len should not be larger than 1 Gb
// if (msg->data_len > 1024 * 1024 * 1024) return 0;
if (msg->header_len + msg->data_len > len) return 0;
if (mask_len > 0) {
uint8_t *p = buf + msg->header_len, *m = p - mask_len;