Throw on invalid payload length in WebSockets

[CarnaViire]

Port of 9eb5680

Description:
Avoid integer overflow to prevent infinite loop in reading from WebSocket. (also complies better with WebSocket RFC)
MSRC 65273 - Prevents DoS attack by sending frames with invalid payload length.

Risk: Low

Impacted assemblies: System.Net.WebSockets.dll

[ghost]

Tagging subscribers to this area: @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Issue Details

---

null

Author:	CarnaViire
Assignees:	-
Labels:	area-System.Net
Milestone:	-

[stephentoub]

(If this doesn't make the RC1 snap, it'll need to be ported over.)

[karelz]

Failures are unrelated:

• System.Runtime - all tests passed, looks like some infra issue
• System.Net.Http.Funtional - Quic test failure (not yet filed)

Process terminated. Assertion failed.
Exception occurred during handling Stream SHUTDOWN_COMPLETE event: System.NullReferenceException: Object reference not set to an instance of an object.
   at System.Net.Quic.Implementations.MsQuic.MsQuicStream.HandleEventConnectionClose(State state) in /_/src/libraries/System.Net.Quic/src/System/Net/Quic/Implementations/MsQuic/MsQuicStream.cs:line 1368
   at System.Net.Quic.Implementations.MsQuic.MsQuicStream.HandleEventShutdownComplete(State state, StreamEvent& evt) in /_/src/libraries/System.Net.Quic/src/System/Net/Quic/Implementations/MsQuic/MsQuicStream.cs:line 1024
   at System.Net.Quic.Implementations.MsQuic.MsQuicStream.HandleEvent(State state, StreamEvent& evt) in /_/src/libraries/System.Net.Quic/src/System/Net/Quic/Implementations/MsQuic/MsQuicStream.cs:line 860
   at System.Net.Quic.Implementations.MsQuic.MsQuicStream.HandleEvent(State state, StreamEvent& evt) in /_/src/libraries/System.Net.Quic/src/System/Net/Quic/Implementations/MsQuic/MsQuicStream.cs:line 860
   at System.Net.Quic.Implementations.MsQuic.MsQuicStream.NativeCallbackHandler(IntPtr stream, IntPtr context, StreamEvent& streamEvent) in /_/src/libraries/System.Net.Quic/src/System/Net/Quic/Implementations/MsQuic/MsQuicStream.cs:line 824

[karelz]

@CarnaViire can you please create ports to branches release/6.0 and release/6.0-rc1? (we will send the 6.0-rc1 one to Tactics first)

[CarnaViire]

/backport to release/6.0-rc1

[github-actions]

Started backporting to release/6.0-rc1: https://github.com/dotnet/runtime/actions/runs/1143099091

[CarnaViire]

/backport to release/6.0

[github-actions]

Started backporting to release/6.0: https://github.com/dotnet/runtime/actions/runs/1143161019

[CarnaViire]

System.Net.Http.Funtional - Quic test failure (not yet filed)

@karelz it was actually filed, though it's not clear from issue's title #55815