[Libreoffice-commits] online.git: Branch 'libreoffice-6-4' - net/WebSocketHandler.hpp

[Michael Meeks (via logerrit)]

 net/WebSocketHandler.hpp |    3 +++
 1 file changed, 3 insertions(+)

New commits:
commit 2812cefd75baaf5f1a7c8bb504923532a0893de2
Author:     Michael Meeks <michael.meeks at collabora.com>
AuthorDate: Mon Jan 6 15:10:02 2020 +0000
Commit:     Andras Timar <andras.timar at collabora.com>
CommitDate: Mon Jan 6 18:04:28 2020 +0100

    Avoid taking address over the end of a vector if reading 0 bytes.
    
    Happens with some close frames eg.
    
    [ docbroker_001 ] TRC  #21: Incoming WebSocket data of 6 bytes: 88 80 4a 2c 44 f9  | ..J,D.|
    
        fin = true
        OpCode is Close (= 0x8)
        hasMask = true
        payloadLen = 0
        headerLen = 2 -> 6 after hasMask is taken into account.
    
    Change-Id: I0e212e4589c3cc63db16f7065dc90cd0bd539ada
    Reviewed-on: https://gerrit.libreoffice.org/c/online/+/86282
    Reviewed-by: Andras Timar <andras.timar at collabora.com>
    Tested-by: Andras Timar <andras.timar at collabora.com>

diff --git a/net/WebSocketHandler.hpp b/net/WebSocketHandler.hpp
index 1d24fa26a..17d364d3a 100644
--- a/net/WebSocketHandler.hpp
+++ b/net/WebSocketHandler.hpp
@@ -607,6 +607,9 @@ protected:
 
     void readPayload(unsigned char *data, size_t dataLen, unsigned char* mask, std::vector<char>& payload)
     {
+        if (dataLen == 0)
+            return;
+
         if (mask)
         {
             size_t end = payload.size();