romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 01:33:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

websockets: check for negative payload lengths

Browse source 
- in en- and decoding, check the websocket frame payload lengths for
  negative values (from curl_off_t) and error the operation in that case
- add test 2307 to verify

Closes #12707
This commit is contained in:
Stefan Eissing 2024-01-15 13:02:34 +01:00 • committed by Daniel Stenberg
parent 9034a16d97
commit 49ca84144e
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
4 changed files with 85 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
lib/ws.c
View file

@ -225,6 +225,10 @@ static CURLcode ws_dec_read_head(struct ws_decoder *dec,
dec->payload_len = (dec->head[2] << 8) | dec->head[3];
break;
case 10:
if(dec->head[2] > 127) {
failf(data, "WS: frame length longer than 64 signed not supported");
return CURLE_RECV_ERROR;
}
dec->payload_len = ((curl_off_t)dec->head[2] << 56) |
(curl_off_t)dec->head[3] << 48 |
(curl_off_t)dec->head[4] << 40 |
@ -410,6 +414,13 @@ static ssize_t ws_enc_write_head(struct Curl_easy *data,
size_t hlen;
ssize_t n;
if(payload_len < 0) {
failf(data, "WS: starting new frame with negative payload length %"
CURL_FORMAT_CURL_OFF_T, payload_len);
*err = CURLE_SEND_ERROR;
return -1;
}
if(enc->payload_remain > 0) {
/* trying to write a new frame before the previous one is finished */
failf(data, "WS: starting new frame with %zd bytes from last one"