[sr-dev] git:master:038c3f16: Merge pull request #1413 from armenb/ws_check_bounds_before_reading_mask

[GitHub]

Module: kamailio
Branch: master
Commit: 038c3f16d9a8371f00b1b8e34d37d6509465a471
URL: https://github.com/kamailio/kamailio/commit/038c3f16d9a8371f00b1b8e34d37d6509465a471

Author: Daniel-Constantin Mierla <miconda at gmail.com>
Committer: GitHub <noreply at github.com>
Date: 2018-01-26T08:50:54+01:00

Merge pull request #1413 from armenb/ws_check_bounds_before_reading_mask

websocket: check bounds before reading mask

---

Modified: src/modules/websocket/ws_frame.c

---

Diff:  https://github.com/kamailio/kamailio/commit/038c3f16d9a8371f00b1b8e34d37d6509465a471.diff
Patch: https://github.com/kamailio/kamailio/commit/038c3f16d9a8371f00b1b8e34d37d6509465a471.patch

---

diff --git a/src/modules/websocket/ws_frame.c b/src/modules/websocket/ws_frame.c
index 2739ecbc11..2d7ca8ec5a 100644
--- a/src/modules/websocket/ws_frame.c
+++ b/src/modules/websocket/ws_frame.c
@@ -470,13 +470,6 @@ static int decode_and_validate_ws_frame(ws_frame_t *frame,
 	} else
 		mask_start = 2;
 
-	/* Decode mask */
-	frame->masking_key[0] = (buf[mask_start + 0] & 0xff);
-	frame->masking_key[1] = (buf[mask_start + 1] & 0xff);
-	frame->masking_key[2] = (buf[mask_start + 2] & 0xff);
-	frame->masking_key[3] = (buf[mask_start + 3] & 0xff);
-
-	/* Decode and unmask payload */
 	if((unsigned long long)len
 			!= (unsigned long long)frame->payload_len + mask_start + 4) {
 		LM_WARN("message not complete frame size %u but received %u\n",
@@ -492,7 +485,15 @@ static int decode_and_validate_ws_frame(ws_frame_t *frame,
 		*err_text = str_status_message_too_big;
 		return -1;
 	}
+	/* Decode mask */
+	frame->masking_key[0] = (buf[mask_start + 0] & 0xff);
+	frame->masking_key[1] = (buf[mask_start + 1] & 0xff);
+	frame->masking_key[2] = (buf[mask_start + 2] & 0xff);
+	frame->masking_key[3] = (buf[mask_start + 3] & 0xff);
+
 	frame->payload_data = &buf[mask_start + 4];
+
+	/* Decode and unmask payload */
 	for(i = 0; i < frame->payload_len; i++) {
 		j = i % 4;
 		frame->payload_data[i] = frame->payload_data[i] ^ frame->masking_key[j];