fix race condition in iOS websocket implementation

[asmeikal]

Summary

The iOS WebSocket implementation has a race condition that causes WebSocket frame payloads to be processed incorrectly.
This can cause errors on RFC6455 compliant WebSocket servers:

• the server sends a ping frame with no payload
• the server sends a text frame with a payload longer than 125 bytes
• the client answers the ping with a pong frame echoing back the contents of the text frame

This is caused by concurrent modification of the current frame contents, that is passed by reference to the handlers. The concurrent modification happens here.

The bug was detected and fixed in the original SocketRocket repository in this PR. The relevant part of the fix is applied in this PR.

Resolves #30020.

Changelog

[iOS] [Fixed] - Fix WebSocket control frames having payloads longer than 125 bytes

Test Plan

The bug is not easily and consistently reproduced, being a race condition.
We were able to reproduce it by connecting a react native app to a websocket server that sent ~100 pings per second and ~100 text frames per second. After a couple of seconds, the server receives an invalid pong message, with a payload equal to the payload of the text frame. The following is a node server that can replicate the problem on a react-native app running on iOS.

const { WebSocketServer } = require('ws');

const wss = new WebSocketServer({ port: 8080 });

wss.on('connection', function connection(ws) {
  const pingInterval = setInterval(() => {
    ws.ping();
  }, 10);

  const sendInterval = setInterval(() => {
    const arr = new Array(100);
    for (let i = 0; i < arr.length; i++) {
      arr[i] = Math.random();
    }
    ws.send('message with payload longer than 125 bytes: ' + arr.join(','));
  }, 10);

  ws.on('close', () => {
    clearInterval(pingInterval);
    clearInterval(sendInterval);
  });

  ws.on('error', (err) => {
    console.error(err);
    process.exit(1);
  });
});

[analysis-bot]

Platform	Engine	Arch	Size (bytes)	Diff
ios	-	universal	n/a	--

Base commit: ca5aaa7
Branch: main

[analysis-bot]

Platform	Engine	Arch	Size (bytes)	Diff
android	hermes	arm64-v8a	8,289,885	+0
android	hermes	armeabi-v7a	7,624,822	+0
android	hermes	x86	8,762,300	+0
android	hermes	x86_64	8,699,301	+0
android	jsc	arm64-v8a	9,678,193	+0
android	jsc	armeabi-v7a	8,669,807	+0
android	jsc	x86	9,636,108	+0
android	jsc	x86_64	10,230,705	+0

Base commit: ca5aaa7
Branch: main

[facebook-github-bot]

@sota000 has imported this pull request. If you are a Meta employee, you can view this diff on Phabricator.

[react-native-bot]

This pull request was successfully merged by @asmeikal in 86db62b.

^{When will my fix make it into a release? | Upcoming Releases}