fix(websocket): prevent OOB read from oversized/wrapped frame length (#852) (#864)

Author: ithewei

http/WebSocketParser.cpp

@@ -12,9 +12,10 @@ static int on_frame_header(websocket_parser* parser) {
     if (opcode != WS_OP_CONTINUE) {
         wp->opcode = opcode;
     }
-    int length = parser->length;
-    int reserve_length = MIN(length + 1, MAX_PAYLOAD_LENGTH);
-    if (reserve_length > wp->message.capacity()) {
+    // parser->length is size_t; use it only as a capacity hint, capped.
+    size_t length = parser->length;
+    size_t reserve_length = MIN(length + 1, (size_t)MAX_PAYLOAD_LENGTH);
+    if (reserve_length > (size_t)wp->message.capacity()) {
         wp->message.reserve(reserve_length);
     }
     if (wp->state == WS_FRAME_BEGIN ||

http/websocket_parser.c

@@ -142,7 +142,8 @@ size_t websocket_parser_execute(websocket_parser *parser, const websocket_parser
                 break;
             case s_body:
                 if(parser->require) {
-                    if(p + parser->require <= end) {
+                    // size_t-safe check: `p + require` can overflow/wrap for a huge require.
+                    if(parser->require <= (size_t)(end - p)) {
                         EMIT_DATA_CB(frame_body, p, parser->require);
                         p += parser->require;
                         parser->require = 0;