From 993636ad8f91c19dbfd9d5ac17b24f3498e436d9 Mon Sep 17 00:00:00 2001 From: Bartosz Sosnowski Date: Wed, 2 Aug 2017 15:05:52 +0200 Subject: [PATCH 1/3] test: read proper inspector message size Fix a bug when messages bigger than 64kb where incorrectly parsed by the inspector-helper. Fixes: https://github.com/nodejs/node/issues/14507 --- test/inspector/inspector-helper.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/inspector/inspector-helper.js b/test/inspector/inspector-helper.js index 35f23dfeb5cba6..3bf4132afcdbce 100644 --- a/test/inspector/inspector-helper.js +++ b/test/inspector/inspector-helper.js @@ -68,7 +68,7 @@ function parseWSFrame(buffer, handler) { dataLen = buffer.readUInt16BE(2); bodyOffset = 4; } else if (dataLen === 127) { - dataLen = buffer.readUInt32BE(2); + dataLen = buffer.readUIntBE(2, 8); bodyOffset = 10; } if (buffer.length < bodyOffset + dataLen) From 3c886e526587993f07ca52fd014e4993ab1e1856 Mon Sep 17 00:00:00 2001 From: Bartosz Sosnowski Date: Wed, 2 Aug 2017 16:31:30 +0200 Subject: [PATCH 2/3] fixup: limit max message size --- test/inspector/inspector-helper.js | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/test/inspector/inspector-helper.js b/test/inspector/inspector-helper.js index 3bf4132afcdbce..6f8db30e0aa7d6 100644 --- a/test/inspector/inspector-helper.js +++ b/test/inspector/inspector-helper.js @@ -68,7 +68,9 @@ function parseWSFrame(buffer, handler) { dataLen = buffer.readUInt16BE(2); bodyOffset = 4; } else if (dataLen === 127) { - dataLen = buffer.readUIntBE(2, 8); + if (buffer[2] !== 0 || buffer[3] !== 0) + assert.fail('Inspector message to big'); + dataLen = buffer.readUIntBE(4, 6); bodyOffset = 10; } if (buffer.length < bodyOffset + dataLen) From ebb912a870bfcfd29df4e7dcab51aa5e0f84cfed Mon Sep 17 00:00:00 2001 From: Bartosz Sosnowski Date: Fri, 4 Aug 2017 13:10:19 +0200 Subject: [PATCH 3/3] fixup: assert, spelling and added link --- test/inspector/inspector-helper.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/inspector/inspector-helper.js b/test/inspector/inspector-helper.js index 6f8db30e0aa7d6..2f45e21c5b0665 100644 --- a/test/inspector/inspector-helper.js +++ b/test/inspector/inspector-helper.js @@ -53,6 +53,7 @@ function sendEnd(socket) { } function parseWSFrame(buffer, handler) { + // Protocol described in https://tools.ietf.org/html/rfc6455#section-5 if (buffer.length < 2) return 0; if (buffer[0] === 0x88 && buffer[1] === 0x00) { @@ -68,8 +69,7 @@ function parseWSFrame(buffer, handler) { dataLen = buffer.readUInt16BE(2); bodyOffset = 4; } else if (dataLen === 127) { - if (buffer[2] !== 0 || buffer[3] !== 0) - assert.fail('Inspector message to big'); + assert(buffer[2] === 0 && buffer[3] === 0, 'Inspector message too big'); dataLen = buffer.readUIntBE(4, 6); bodyOffset = 10; }