Fragments forming a long message are not caught early

yongju-hong · Dec 31, 2019 · 54dd866 · 54dd866
1 parent b9062ec
commit 54dd866
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 2 deletions.
diff --git a/fuzzing/Makefile b/fuzzing/Makefile
@@ -1,8 +1,8 @@
 # You can select which sanitizer to use by setting this
 SANITIZER ?= address
 # These are set by OSS-Fuzz, we default to AddressSanitizer
-CXXFLAGS ?= -DLIBUS_NO_SSL -fsanitize=$(SANITIZER),fuzzer
-CFLAGS ?= -DLIBUS_NO_SSL
+override CXXFLAGS += -DLIBUS_NO_SSL -fsanitize=$(SANITIZER),fuzzer
+override CFLAGS += -DLIBUS_NO_SSL
 OUT ?= .
 
 oss-fuzz:

diff --git a/src/WebSocketContext.h b/src/WebSocketContext.h
@@ -100,6 +100,11 @@ struct WebSocketContext {
                 if (!webSocketData->fragmentBuffer.length()) {
                     webSocketData->fragmentBuffer.reserve(length + remainingBytes);
                 }
+                /* Fragments forming a big message are not caught until appending them */
+                if (refusePayloadLength(length + webSocketData->fragmentBuffer.length(), webSocketState, s)) {
+                    forceClose(webSocketState, s);
+                    return true;
+                }
                 webSocketData->fragmentBuffer.append(data, length);
 
                 /* Are we done now? */