|
| 1 | +From 5490a512d99134eb2c8cdf0b0735bd72a14e5945 Mon Sep 17 00:00:00 2001 |
| 2 | +From: Ivan Kozlovic <ivan@synadia.com> |
| 3 | +Date: Mon, 8 Dec 2025 10:25:20 -0700 |
| 4 | +Subject: [PATCH] Websocket: limit buffer size during decompression of a frame |
| 5 | + |
| 6 | +When the server would decompress a compressed websocket frame, it would |
| 7 | +not limit the resulting size of the uncompressed buffer. Once uncompressed |
| 8 | +the maximum payload size would still be used to reject messages that |
| 9 | +are too big, but the server would have already uncompressed a possibly |
| 10 | +very big buffer (if the frame contained highly compressed data). |
| 11 | + |
| 12 | +This PR limits the number of bytes that are being decompressed using |
| 13 | +the maximum payload size as a limit. |
| 14 | + |
| 15 | +Credit goes to: |
| 16 | +Pavel Kohout, Aisle Research (www.aisle.com) for reporting the issue |
| 17 | +and providing a path. |
| 18 | + |
| 19 | +The propose patched as been updated a bit (need to use atomic to |
| 20 | +use the connection's max payload value) and some tweaks around |
| 21 | +the use of the `io.LimitedReader`. |
| 22 | + |
| 23 | +Signed-off-by: Ivan Kozlovic <ivan@synadia.com> |
| 24 | +Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> |
| 25 | +Upstream-reference: https://github.com/nats-io/nats-server/commit/f77fb7c4535e6727cc1a2899cd8e6bbdd8ba2017.patch |
| 26 | +--- |
| 27 | + .../nats-server/v2/server/websocket.go | 26 ++++++++++++++++--- |
| 28 | + 1 file changed, 22 insertions(+), 4 deletions(-) |
| 29 | + |
| 30 | +diff --git a/vendor/github.com/nats-io/nats-server/v2/server/websocket.go b/vendor/github.com/nats-io/nats-server/v2/server/websocket.go |
| 31 | +index e026674d..1804b4de 100644 |
| 32 | +--- a/vendor/github.com/nats-io/nats-server/v2/server/websocket.go |
| 33 | ++++ b/vendor/github.com/nats-io/nats-server/v2/server/websocket.go |
| 34 | +@@ -31,6 +31,7 @@ import ( |
| 35 | + "strconv" |
| 36 | + "strings" |
| 37 | + "sync" |
| 38 | ++ "sync/atomic" |
| 39 | + "time" |
| 40 | + "unicode/utf8" |
| 41 | + |
| 42 | +@@ -203,6 +204,7 @@ func (c *client) wsRead(r *wsReadInfo, ior io.Reader, buf []byte) ([][]byte, err |
| 43 | + err error |
| 44 | + pos int |
| 45 | + max = len(buf) |
| 46 | ++ mpay = int(atomic.LoadInt32(&c.mpay)) |
| 47 | + ) |
| 48 | + for pos != max { |
| 49 | + if r.fs { |
| 50 | +@@ -316,7 +318,7 @@ func (c *client) wsRead(r *wsReadInfo, ior io.Reader, buf []byte) ([][]byte, err |
| 51 | + // When we have the final frame and we have read the full payload, |
| 52 | + // we can decompress it. |
| 53 | + if r.ff && r.rem == 0 { |
| 54 | +- b, err = r.decompress() |
| 55 | ++ b, err = r.decompress(mpay) |
| 56 | + if err != nil { |
| 57 | + return bufs, err |
| 58 | + } |
| 59 | +@@ -390,7 +392,16 @@ func (r *wsReadInfo) ReadByte() (byte, error) { |
| 60 | + return b, nil |
| 61 | + } |
| 62 | + |
| 63 | +-func (r *wsReadInfo) decompress() ([]byte, error) { |
| 64 | ++// decompress decompresses the collected buffers. |
| 65 | ++// The size of the decompressed buffer will be limited to the `mpay` value. |
| 66 | ++// If, while decompressing, the resulting uncompressed buffer exceeds this |
| 67 | ++// limit, the decompression stops and an empty buffer and the ErrMaxPayload |
| 68 | ++// error are returned. |
| 69 | ++func (r *wsReadInfo) decompress(mpay int) ([]byte, error) { |
| 70 | ++ // If not limit is specified, use the default maximum payload size. |
| 71 | ++ if mpay <= 0 { |
| 72 | ++ mpay = MAX_PAYLOAD_SIZE |
| 73 | ++ } |
| 74 | + r.coff = 0 |
| 75 | + // As per https://tools.ietf.org/html/rfc7692#section-7.2.2 |
| 76 | + // add 0x00, 0x00, 0xff, 0xff and then a final block so that flate reader |
| 77 | +@@ -405,8 +416,15 @@ func (r *wsReadInfo) decompress() ([]byte, error) { |
| 78 | + } else { |
| 79 | + d.(flate.Resetter).Reset(r, nil) |
| 80 | + } |
| 81 | +- // This will do the decompression. |
| 82 | +- b, err := io.ReadAll(d) |
| 83 | ++ // Use a LimitedReader to limit the decompressed size. |
| 84 | ++ // We use "limit+1" bytes for "N" so we can detect if the limit is exceeded. |
| 85 | ++ lr := io.LimitedReader{R: d, N: int64(mpay + 1)} |
| 86 | ++ b, err := io.ReadAll(&lr) |
| 87 | ++ if err == nil && len(b) > mpay { |
| 88 | ++ // Decompressed data exceeds the maximum payload size. |
| 89 | ++ b, err = nil, ErrMaxPayload |
| 90 | ++ } |
| 91 | ++ lr.R = nil |
| 92 | + decompressorPool.Put(d) |
| 93 | + // Now reset the compressed buffers list. |
| 94 | + r.cbufs = nil |
| 95 | +-- |
| 96 | +2.45.4 |
| 97 | + |
0 commit comments