@@ -60,22 +60,36 @@ class websocket {
6060 if (length_field <= 125 ) {
6161 len_bytes_ = SHORT_HEADER ;
6262 payload_length_ = length_field;
63+ left_header_len_ =
64+ is_server ? SHORT_HEADER - size : CLIENT_SHORT_HEADER - size;
65+ if (left_header_len_ > 0 ) {
66+ // The frame length field or mask field was not received completely
67+ return ws_header_status::incomplete;
68+ }
6369 }
6470 else if (length_field == 126 ) // msglen is 16bit!
6571 {
6672 len_bytes_ = MEDIUM_HEADER ;
67- payload_length_ = ntohs (*(uint16_t *)&inp[2 ]); // (inp[2] << 8) + inp[3];
68- pos += 2 ;
6973 left_header_len_ =
7074 is_server ? MEDIUM_HEADER - size : CLIENT_MEDIUM_HEADER - size;
75+ if (left_header_len_ > 0 ) {
76+ // The frame length field or mask field was not received completely
77+ return ws_header_status::incomplete;
78+ }
79+ payload_length_ = ntohs (*(uint16_t *)&inp[2 ]); // (inp[2] << 8) + inp[3];
80+ pos += 2 ;
7181 }
7282 else if (length_field == 127 ) // msglen is 64bit!
7383 {
7484 len_bytes_ = LONG_HEADER ;
75- payload_length_ = (size_t )be64toh (*(uint64_t *)&inp[2 ]);
76- pos += 8 ;
7785 left_header_len_ =
7886 is_server ? LONG_HEADER - size : CLIENT_LONG_HEADER - size;
87+ if (left_header_len_ > 0 ) {
88+ // The frame length field or mask field was not received completely
89+ return ws_header_status::incomplete;
90+ }
91+ payload_length_ = (size_t )be64toh (*(uint64_t *)&inp[2 ]);
92+ pos += 8 ;
7993 }
8094 else {
8195 len_bytes_ = INVALID_HEADER ;
0 commit comments