You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@hc.apache.org by ab...@apache.org on 2026/07/21 09:46:32 UTC
(httpcomponents-client) branch master updated: reject negative 64-bit payload length in WebSocketFrameReader
This is an automated email from the ASF dual-hosted git repository.
arturobernalg pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/httpcomponents-client.git
The following commit(s) were added to refs/heads/master by this push:
new a50d07a22 reject negative 64-bit payload length in WebSocketFrameReader
a50d07a22 is described below
commit a50d07a22655e1c1739e49f16a53ecd1e6c50fb8
Author: Javid Khan <dx...@gmail.com>
AuthorDate: Sat Jul 18 15:47:01 2026 +0530
reject negative 64-bit payload length in WebSocketFrameReader
---
.../org/apache/hc/core5/websocket/WebSocketFrameReader.java | 3 +++
.../apache/hc/core5/websocket/WebSocketFrameReaderTest.java | 12 ++++++++++++
2 files changed, 15 insertions(+)
diff --git a/httpclient5-websocket/src/main/java/org/apache/hc/core5/websocket/WebSocketFrameReader.java b/httpclient5-websocket/src/main/java/org/apache/hc/core5/websocket/WebSocketFrameReader.java
index 702cd74cc..fb14e941b 100644
--- a/httpclient5-websocket/src/main/java/org/apache/hc/core5/websocket/WebSocketFrameReader.java
+++ b/httpclient5-websocket/src/main/java/org/apache/hc/core5/websocket/WebSocketFrameReader.java
@@ -97,6 +97,9 @@ WebSocketFrame readFrame() throws IOException {
for (int i = 0; i < 8; i++) {
len = (len << 8) | (readByte() & 0xFF);
}
+ if (len < 0) {
+ throw new WebSocketException("Negative frame payload length");
+ }
}
if (len > Integer.MAX_VALUE) {
throw new WebSocketException("Frame payload too large: " + len);
diff --git a/httpclient5-websocket/src/test/java/org/apache/hc/core5/websocket/WebSocketFrameReaderTest.java b/httpclient5-websocket/src/test/java/org/apache/hc/core5/websocket/WebSocketFrameReaderTest.java
index c70921bbe..d11ab009a 100644
--- a/httpclient5-websocket/src/test/java/org/apache/hc/core5/websocket/WebSocketFrameReaderTest.java
+++ b/httpclient5-websocket/src/test/java/org/apache/hc/core5/websocket/WebSocketFrameReaderTest.java
@@ -160,4 +160,16 @@ void frame_too_large_throws() {
final ByteBuffer f = maskedFrame(0x82, new byte[len]);
assertThrows(WebSocketException.class, () -> readFrame(f, 1024));
}
+
+ @Test
+ void negative_extended_length_is_rejected() {
+ final ByteBuffer f = ByteBuffer.allocate(2 + 8 + 4 + 5);
+ f.put((byte) 0x81); // FIN|TEXT
+ f.put((byte) (0x80 | 127)); // MASK, 64-bit length
+ f.putLong(0xFFFFFFFF00000000L); // MSB set: not a valid payload length
+ f.put(MASK_KEY);
+ f.put(new byte[5]);
+ f.flip();
+ assertThrows(WebSocketException.class, () -> readFrame(f, 8192));
+ }
}