From f37e5ecc38fdc59e86e846d8bf26c89ed09b3434 Mon Sep 17 00:00:00 2001
From: Sergey Lyubka <valenok@gmail.com>
Date: Tue, 14 Sep 2021 10:26:03 +0100
Subject: [PATCH] WS frame len sanity check

---
 mongoose.c | 3 +++
 src/ws.c   | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/mongoose.c b/mongoose.c
index 24a30a09..046dd149 100644
--- a/mongoose.c
+++ b/mongoose.c
@@ -4547,6 +4547,9 @@ static size_t ws_process(uint8_t *buf, size_t len, struct ws_msg *msg) {
           mg_ntohl(*(uint32_t *) &buf[6]);
     }
   }
+  // Sanity check, and integer overflow protection for the boundary check below
+  // data_len should not be larger than 1 Gb
+  // if (msg->data_len > 1024 * 1024 * 1024) return 0;
   if (msg->header_len + msg->data_len > len) return 0;
   if (mask_len > 0) {
     uint8_t *p = buf + msg->header_len, *m = p - mask_len;
diff --git a/src/ws.c b/src/ws.c
index e6c5db14..28cb7074 100644
--- a/src/ws.c
+++ b/src/ws.c
@@ -64,6 +64,9 @@ static size_t ws_process(uint8_t *buf, size_t len, struct ws_msg *msg) {
           mg_ntohl(*(uint32_t *) &buf[6]);
     }
   }
+  // Sanity check, and integer overflow protection for the boundary check below
+  // data_len should not be larger than 1 Gb
+  // if (msg->data_len > 1024 * 1024 * 1024) return 0;
   if (msg->header_len + msg->data_len > len) return 0;
   if (mask_len > 0) {
     uint8_t *p = buf + msg->header_len, *m = p - mask_len;