fix: prevent pointer-wrap and oversized-length OOB reads in WebSocket parser

[Copilot]

Attacker-controlled WebSocket frames with extreme 64-bit payload lengths could cause pointer arithmetic to wrap in the C parser, invoking on_frame_body with length ≈ SIZE_MAX and triggering an out-of-bounds read when libhv's C++ layer called append/websocket_parser_decode with that length.

http/websocket_parser.c

• s_length — RFC 6455 §5.2 enforcement: after accumulating the extended length bytes, reject any frame whose declared length has the MSB set (the spec requires it to be 0). Stops the exploit before the frame ever reaches s_body.

  if (parser->length > ((size_t)~(size_t)0 >> 1)) {
      return GET_NPARSED();
  }

• s_body — pointer-arithmetic wrap fix: p + parser->require <= end wraps when require is huge. Replaced with the size_t-safe form:

  // before
  if(p + parser->require <= end)
  // after
  if(parser->require <= (size_t)(end - p))

http/WebSocketParser.cpp

• on_frame_header — size_t→int truncation: int length = parser->length silently truncates large values. Changed to size_t length.

• on_frame_header — MAX_PAYLOAD_LENGTH guard: returns 1 (halts parsing) for any frame declaring a payload > 16 MB, so on_frame_body is never reached with an attacker-supplied oversized length. This is a defence-in-depth layer on top of the C-level fixes.

• Fixes WebSocketParser: oversized body length after pointer wrap in vendored websocket_parser (related php-ion#5) #852

[Copilot]

Pull request overview

This PR hardens libhv’s WebSocket frame parsing against attacker-controlled oversized payload lengths that could previously lead to pointer-arithmetic wrap and out-of-bounds reads (and related crash/DoS scenarios) across the C parser and the C++ wrapper.

Changes:

• Adds RFC 6455 §5.2 validation to reject 64-bit payload lengths with the MSB set in the C WebSocket parser.
• Fixes a pointer-arithmetic wrap hazard in the C parser by switching to a remaining-bytes comparison (require <= end - p).
• Updates the C++ wrapper to avoid size_t -> int truncation and introduces a maximum payload length guard.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
http/WebSocketParser.cpp	Adds size_t-safe length handling and a max payload length rejection guard in the C++ wrapper callbacks.
http/websocket_parser.c	Adds RFC length validation and fixes the body-availability check to avoid pointer-wrap issues in the C parser.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.