Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(ws_transport): reject oversized 64-bit WebSocket payload length

Browse Source
This commit is contained in:
surengab
2026-06-12 11:59:58 +02:00
committed by Euripedes Rocha
parent 839352f836
commit 4bdf427ca1
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/tcp_transport/transport_ws.c
+8 -5
View File
@@ -626,12 +626,15 @@ static int ws_read_header(esp_transport_handle_t t, char *buffer, int len, int t
return rlen; return rlen;
} }
if (data_ptr[0] != 0 || data_ptr[1] != 0 || data_ptr[2] != 0 || data_ptr[3] != 0) { if (data_ptr[0] != 0 || data_ptr[1] != 0 || data_ptr[2] != 0 || data_ptr[3] != 0 ||
// really too big! ((uint8_t)data_ptr[4] & 0x80)) {
payload_len = 0xFFFFFFFF; ESP_LOGE(TAG, "Payload length out of range");
} else { return -1;
payload_len = (uint8_t)data_ptr[4] << 24 | (uint8_t)data_ptr[5] << 16 | (uint8_t)data_ptr[6] << 8 | data_ptr[7];
} }
payload_len = (int)((uint32_t)(uint8_t)data_ptr[4] << 24 |
(uint32_t)(uint8_t)data_ptr[5] << 16 |
(uint32_t)(uint8_t)data_ptr[6] << 8 |
(uint32_t)(uint8_t)data_ptr[7]);
} }
// RFC 6455 Section 5.5: Control frames MUST have payload length of 125 bytes or less // RFC 6455 Section 5.5: Control frames MUST have payload length of 125 bytes or less
if ((ws->frame_state.opcode & WS_OPCODE_CONTROL_FRAME) && payload_len > 125) { if ((ws->frame_state.opcode & WS_OPCODE_CONTROL_FRAME) && payload_len > 125) {