소스 검색

websocket: fix checking payload_len safety check for fragmentation

- a crafted websocket frame  using values spanning max unsinged int could have
  caused a failed detection of unsupported fragmentation and invalid memory access
- thanks to Peter Dunkley and Hugh Waite for assisting and pin-pointing
  where everything happens
Daniel-Constantin Mierla 11 년 전
부모
커밋
6b8acf3204
1개의 변경된 파일2개의 추가작업 그리고 1개의 파일을 삭제
  1. 2 1
      modules/websocket/ws_frame.c

+ 2 - 1
modules/websocket/ws_frame.c

@@ -536,7 +536,8 @@ static int decode_and_validate_ws_frame(ws_frame_t *frame,
 	frame->masking_key[3] = (buf[mask_start + 3] & 0xff);
 
 	/* Decode and unmask payload */
-	if (len != frame->payload_len + mask_start + 4)
+	if ((unsigned long long)len != (unsigned long long)frame->payload_len
+										+ mask_start + 4)
 	{
 		LM_WARN("message not complete frame size %u but received %u\n",
 			frame->payload_len + mask_start + 4, len);