Skip to content

Commit

Permalink
fix(ws_transport): Fix crash when reading
Browse files Browse the repository at this point in the history
When parsing WS framing protocol integer promotion would cause
invalid values to be read. Acting upon these values would eventually
cause a crash

Fixes esp-protocols#645
  • Loading branch information
Sean-Der committed Sep 9, 2024
1 parent 59e1838 commit 58775cc
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions components/tcp_transport/transport_ws.c
Original file line number Diff line number Diff line change
Expand Up @@ -504,7 +504,7 @@ static int ws_read_header(esp_transport_handle_t t, char *buffer, int len, int t
ESP_LOGE(TAG, "Error read data");
return rlen;
}
payload_len = data_ptr[0] << 8 | data_ptr[1];
payload_len = (uint8_t)data_ptr[0] << 8 | (uint8_t)data_ptr[1];
} else if (payload_len == 127) {
// headerLen += 8;
header = 8;
Expand All @@ -517,7 +517,7 @@ static int ws_read_header(esp_transport_handle_t t, char *buffer, int len, int t
// really too big!
payload_len = 0xFFFFFFFF;
} else {
payload_len = data_ptr[4] << 24 | data_ptr[5] << 16 | data_ptr[6] << 8 | data_ptr[7];
payload_len = (uint8_t)data_ptr[4] << 24 | (uint8_t)data_ptr[5] << 16 | (uint8_t)data_ptr[6] << 8 | data_ptr[7];
}
}

Expand Down

0 comments on commit 58775cc

Please sign in to comment.