Browse Source

websocket: fix checking payload_len safety check for fragmentation

- a crafted websocket frame  using values spanning max unsinged int could have
  caused a failed detection of unsupported fragmentation and invalid memory access
- thanks to Peter Dunkley and Hugh Waite for assisting and pin-pointing
  where everything happens
Daniel-Constantin Mierla 11 years ago
parent
commit
6b8acf3204
1 changed files with 2 additions and 1 deletions
  1. 2 1
      modules/websocket/ws_frame.c

+ 2 - 1
modules/websocket/ws_frame.c

@@ -536,7 +536,8 @@ static int decode_and_validate_ws_frame(ws_frame_t *frame,
 	frame->masking_key[3] = (buf[mask_start + 3] & 0xff);
 
 	/* Decode and unmask payload */
-	if (len != frame->payload_len + mask_start + 4)
+	if ((unsigned long long)len != (unsigned long long)frame->payload_len
+										+ mask_start + 4)
 	{
 		LM_WARN("message not complete frame size %u but received %u\n",
 			frame->payload_len + mask_start + 4, len);