Skip to content

Commit

Permalink
fix(ws_transport): fixed server-key corruption
Browse files Browse the repository at this point in the history
When first fragment is sent over HTTP during websocket
connection, defer buffering of fragment until after the
websocket server-key is validated.

This order is required because the first fragment buffering
overwrites the memory holding the server-key headers.

Fixes 2267d4b
Fixes espressif/esp-protocols#396
PR #13724
  • Loading branch information
bryghtlabs-richard authored and euripedesrocha committed Aug 21, 2024
1 parent 373e70d commit a97a796
Showing 1 changed file with 16 additions and 14 deletions.
30 changes: 16 additions & 14 deletions components/tcp_transport/transport_ws.c
Original file line number Diff line number Diff line change
Expand Up @@ -307,20 +307,6 @@ static int ws_connect(esp_transport_handle_t t, const char *host, int port, int
return -1;
}

if (delim_ptr != NULL) {
size_t delim_pos = delim_ptr - ws->buffer + sizeof(delimiter) - 1;
size_t remaining_len = ws->buffer_len - delim_pos;
if (remaining_len > 0) {
memmove(ws->buffer, ws->buffer + delim_pos, remaining_len);
ws->buffer_len = remaining_len;
} else {
#ifdef CONFIG_WS_DYNAMIC_BUFFER
free(ws->buffer);
ws->buffer = NULL;
#endif
ws->buffer_len = 0;
}
}
// See esp_crypto_sha1() arg size
unsigned char expected_server_sha1[20];
// Size of base64 coded string see above
Expand All @@ -340,6 +326,22 @@ static int ws_connect(esp_transport_handle_t t, const char *host, int port, int
ESP_LOGE(TAG, "Invalid websocket key");
return -1;
}

if (delim_ptr != NULL) {
size_t delim_pos = delim_ptr - ws->buffer + sizeof(delimiter) - 1;
size_t remaining_len = ws->buffer_len - delim_pos;
if (remaining_len > 0) {
memmove(ws->buffer, ws->buffer + delim_pos, remaining_len);
ws->buffer_len = remaining_len;
} else {
#ifdef CONFIG_WS_DYNAMIC_BUFFER
free(ws->buffer);
ws->buffer = NULL;
#endif
ws->buffer_len = 0;
}
}

return 0;
}

Expand Down

0 comments on commit a97a796

Please sign in to comment.