5 ex_network_ws_limits_8c example
gullradriel edited this page 2026-10-09 00:51:57 +02:00

ex_network_ws_limits.c

n_ws_recv frame-length bound: a peer-declared payload length is read straight off the wire, so it is bounded BEFORE it sizes an allocation. A frame header carries its payload length in up to 64 bits. Near the maximum, the terminator arithmetic (length + 1) wraps to zero and the allocation comes back a single byte, after which reading the declared payload writes past it. Below that, a merely enormous length is an invitation to exhaust memory. This connects a client to a local listener, has the listener send each hostile header, and checks that n_ws_recv refuses rather than allocates.