From c43a7eae7a8b70040222ecdfcb56f35b815b7990 Mon Sep 17 00:00:00 2001 From: Javid Khan Date: Sat, 18 Jul 2026 15:47:01 +0530 Subject: [PATCH] reject negative 64-bit payload length in WebSocketFrameReader --- .../hc/core5/websocket/WebSocketFrameReader.java | 3 +++ .../hc/core5/websocket/WebSocketFrameReaderTest.java | 12 ++++++++++++ 2 files changed, 15 insertions(+) diff --git a/httpclient5-websocket/src/main/java/org/apache/hc/core5/websocket/WebSocketFrameReader.java b/httpclient5-websocket/src/main/java/org/apache/hc/core5/websocket/WebSocketFrameReader.java index 702cd74cce..fb14e941b7 100644 --- a/httpclient5-websocket/src/main/java/org/apache/hc/core5/websocket/WebSocketFrameReader.java +++ b/httpclient5-websocket/src/main/java/org/apache/hc/core5/websocket/WebSocketFrameReader.java @@ -97,6 +97,9 @@ WebSocketFrame readFrame() throws IOException { for (int i = 0; i < 8; i++) { len = (len << 8) | (readByte() & 0xFF); } + if (len < 0) { + throw new WebSocketException("Negative frame payload length"); + } } if (len > Integer.MAX_VALUE) { throw new WebSocketException("Frame payload too large: " + len); diff --git a/httpclient5-websocket/src/test/java/org/apache/hc/core5/websocket/WebSocketFrameReaderTest.java b/httpclient5-websocket/src/test/java/org/apache/hc/core5/websocket/WebSocketFrameReaderTest.java index c70921bbec..d11ab009a6 100644 --- a/httpclient5-websocket/src/test/java/org/apache/hc/core5/websocket/WebSocketFrameReaderTest.java +++ b/httpclient5-websocket/src/test/java/org/apache/hc/core5/websocket/WebSocketFrameReaderTest.java @@ -160,4 +160,16 @@ void frame_too_large_throws() { final ByteBuffer f = maskedFrame(0x82, new byte[len]); assertThrows(WebSocketException.class, () -> readFrame(f, 1024)); } + + @Test + void negative_extended_length_is_rejected() { + final ByteBuffer f = ByteBuffer.allocate(2 + 8 + 4 + 5); + f.put((byte) 0x81); // FIN|TEXT + f.put((byte) (0x80 | 127)); // MASK, 64-bit length + f.putLong(0xFFFFFFFF00000000L); // MSB set: not a valid payload length + f.put(MASK_KEY); + f.put(new byte[5]); + f.flip(); + assertThrows(WebSocketException.class, () -> readFrame(f, 8192)); + } }