From 58775cce6eaff037a2003ebb733ef62ad0d91b9b Mon Sep 17 00:00:00 2001 From: Sean DuBois Date: Mon, 9 Sep 2024 12:31:51 -0400 Subject: [PATCH] fix(ws_transport): Fix crash when reading When parsing WS framing protocol integer promotion would cause invalid values to be read. Acting upon these values would eventually cause a crash Fixes esp-protocols#645 --- components/tcp_transport/transport_ws.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/components/tcp_transport/transport_ws.c b/components/tcp_transport/transport_ws.c index 4aaa1845ed9a..2d4e416d17f8 100644 --- a/components/tcp_transport/transport_ws.c +++ b/components/tcp_transport/transport_ws.c @@ -504,7 +504,7 @@ static int ws_read_header(esp_transport_handle_t t, char *buffer, int len, int t ESP_LOGE(TAG, "Error read data"); return rlen; } - payload_len = data_ptr[0] << 8 | data_ptr[1]; + payload_len = (uint8_t)data_ptr[0] << 8 | (uint8_t)data_ptr[1]; } else if (payload_len == 127) { // headerLen += 8; header = 8; @@ -517,7 +517,7 @@ static int ws_read_header(esp_transport_handle_t t, char *buffer, int len, int t // really too big! payload_len = 0xFFFFFFFF; } else { - payload_len = data_ptr[4] << 24 | data_ptr[5] << 16 | data_ptr[6] << 8 | data_ptr[7]; + payload_len = (uint8_t)data_ptr[4] << 24 | (uint8_t)data_ptr[5] << 16 | (uint8_t)data_ptr[6] << 8 | data_ptr[7]; } }