From 54dd866a84cc59cf2fcee32863775d3aa1453d93 Mon Sep 17 00:00:00 2001 From: Alex Hultman Date: Tue, 31 Dec 2019 12:56:45 +0100 Subject: [PATCH] Fragments forming a long message are not caught early --- fuzzing/Makefile | 4 ++-- src/WebSocketContext.h | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/fuzzing/Makefile b/fuzzing/Makefile index 0c17ebf..f20a238 100644 --- a/fuzzing/Makefile +++ b/fuzzing/Makefile @@ -1,8 +1,8 @@ # You can select which sanitizer to use by setting this SANITIZER ?= address # These are set by OSS-Fuzz, we default to AddressSanitizer -CXXFLAGS ?= -DLIBUS_NO_SSL -fsanitize=$(SANITIZER),fuzzer -CFLAGS ?= -DLIBUS_NO_SSL +override CXXFLAGS += -DLIBUS_NO_SSL -fsanitize=$(SANITIZER),fuzzer +override CFLAGS += -DLIBUS_NO_SSL OUT ?= . oss-fuzz: diff --git a/src/WebSocketContext.h b/src/WebSocketContext.h index fb96fa9..014e980 100644 --- a/src/WebSocketContext.h +++ b/src/WebSocketContext.h @@ -100,6 +100,11 @@ private: if (!webSocketData->fragmentBuffer.length()) { webSocketData->fragmentBuffer.reserve(length + remainingBytes); } + /* Fragments forming a big message are not caught until appending them */ + if (refusePayloadLength(length + webSocketData->fragmentBuffer.length(), webSocketState, s)) { + forceClose(webSocketState, s); + return true; + } webSocketData->fragmentBuffer.append(data, length); /* Are we done now? */