alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-10-05 20:47:46 -04:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

fix(ws_transport): Fix crash when reading

Browse Source 
When parsing WS framing protocol integer promotion would cause
invalid values to be read. Acting upon these values would eventually
cause a crash

Fixes esp-protocols#645
This commit is contained in:
Sean DuBois 2024-09-09 12:31:51 -04:00
parent 59e1838270
commit 58775cce6e
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
components/tcp_transport/transport_ws.c
View File

@ -504,7 +504,7 @@ static int ws_read_header(esp_transport_handle_t t, char *buffer, int len, int t
ESP_LOGE(TAG, "Error read data"); ESP_LOGE(TAG, "Error read data");
return rlen; return rlen;
} }
payload_len = data_ptr[0] << 8 | data_ptr[1]; payload_len = (uint8_t)data_ptr[0] << 8 | (uint8_t)data_ptr[1];
} else if (payload_len == 127) { } else if (payload_len == 127) {
// headerLen += 8; // headerLen += 8;
header = 8; header = 8;
@ -517,7 +517,7 @@ static int ws_read_header(esp_transport_handle_t t, char *buffer, int len, int t
// really too big! // really too big!
payload_len = 0xFFFFFFFF; payload_len = 0xFFFFFFFF;
} else { } else {
payload_len = data_ptr[4] << 24 | data_ptr[5] << 16 | data_ptr[6] << 8 | data_ptr[7]; payload_len = (uint8_t)data_ptr[4] << 24 | (uint8_t)data_ptr[5] << 16 | (uint8_t)data_ptr[6] << 8 | data_ptr[7];
} }
} }