Check for int overflow when parsing WS frames

PUBLISHED_FROM=b7325b38e881455df703b0b628c41931565ccb33

Check for int overflow when parsing WS frames
PUBLISHED_FROM=b7325b38e881455df703b0b628c41931565ccb33
c8af7cdd · Deomid Ryabkov · Cesanta Bot · f857f639 · c8af7cdd
Commit c8af7cdd authored Sep 06, 2017 by Deomid Ryabkov Committed by Cesanta Bot Sep 06, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 7 additions and 1 deletion

mongoose.c mongoose.c +7 -1

No files found.
--- a/mongoose.c
+++ b/mongoose.c
@@ -9204,7 +9204,13 @@ static int mg_deliver_websocket_data(struct mg_connection *nc) {
  }

  frame_len = header_len + data_len;
-  ok = frame_len > 0 && frame_len <= buf_len;
+  ok = (frame_len > 0 && frame_len <= buf_len);
+
+  /* Check for overflow */
+  if (frame_len < header_len || frame_len < data_len) {
+    ok = 0;
+    nc->flags |= MG_F_CLOSE_IMMEDIATELY;
+  }

  if (ok) {
    struct websocket_message wsm;