Websocket offset validation enhancement

Author: robert

mongoose.c

@@ -19719,7 +19719,7 @@ static void mg_ws_cb(struct mg_connection *c, int ev, void *ev_data) {
       // Remove non-fragmented frame
       if (final && op) mg_iobuf_del(&c->recv, ofs, len);
       // Last chunk of the fragmented frame
-      if (final && !op) {
+      if (final && !op && (ofs > 0)) {
         m.flags = c->recv.buf[0];
         m.data = mg_str_n((char *) &c->recv.buf[1], (size_t) (ofs - 1));
         mg_call(c, MG_EV_WS_MSG, &m);

src/ws.c

@@ -219,7 +219,7 @@ static void mg_ws_cb(struct mg_connection *c, int ev, void *ev_data) {
       // Remove non-fragmented frame
       if (final && op) mg_iobuf_del(&c->recv, ofs, len);
       // Last chunk of the fragmented frame
-      if (final && !op) {
+      if (final && !op && (ofs > 0)) {
         m.flags = c->recv.buf[0];
         m.data = mg_str_n((char *) &c->recv.buf[1], (size_t) (ofs - 1));
         mg_call(c, MG_EV_WS_MSG, &m);

test/unit_test.c

@@ -811,6 +811,7 @@ static void wcb(struct mg_connection *c, int ev, void *ev_data) {
     struct mg_http_message *hm = (struct mg_http_message *) ev_data;
     struct mg_str *wsproto = mg_http_get_header(hm, "Sec-WebSocket-Protocol");
     ASSERT(wsproto != NULL);
+    mg_ws_send(c, "hello", 0, 0);
     mg_ws_printf(c, WEBSOCKET_OP_BINARY, "%.3s", "boo!!!!");
     mg_ws_printf(c, WEBSOCKET_OP_BINARY, "%s", "foobar");
     mg_ws_send(c, "", 0, WEBSOCKET_OP_PING);