espressif/esp-idf
1
0
Fork 1
mirror of https://github.com/espressif/esp-idf.git synced 2025-07-29 18:27:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(ws_transport): Fix crash when reading

Browse Source 
When parsing WS framing protocol integer promotion would cause
invalid values to be read. Acting upon these values would eventually
cause a crash

Fixes esp-protocols#645
This commit is contained in:
Sean DuBois
2024-09-09 12:31:51 -04:00
committed by David Cermak
parent 8218cdd7fb
commit 226fde9f91
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
components/tcp_transport/transport_ws.c
View File

@ -502,7 +502,7 @@ static int ws_read_header(esp_transport_handle_t t, char *buffer, int len, int t
ESP_LOGE(TAG, "Error read data");
return rlen;
}
payload_len = data_ptr[0] << 8 | data_ptr[1];
payload_len = (uint8_t)data_ptr[0] << 8 | (uint8_t)data_ptr[1];
} else if (payload_len == 127) {
// headerLen += 8;
header = 8;
@ -515,7 +515,7 @@ static int ws_read_header(esp_transport_handle_t t, char *buffer, int len, int t
// really too big!
payload_len = 0xFFFFFFFF;
} else {
payload_len = data_ptr[4] << 24 | data_ptr[5] << 16 | data_ptr[6] << 8 | data_ptr[7];
payload_len = (uint8_t)data_ptr[4] << 24 | (uint8_t)data_ptr[5] << 16 | (uint8_t)data_ptr[6] << 8 | data_ptr[7];
}
}