Module: kamailio Branch: master Commit: 8625d6ab72479afb6b92f5c9ca54265be54153db URL: https://github.com/kamailio/kamailio/commit/8625d6ab72479afb6b92f5c9ca54265be54153db
Author: Daniel-Constantin Mierla <[email protected]> Committer: Daniel-Constantin Mierla <[email protected]> Date: 2026-06-24T11:06:30+02:00 websocket: keep fragmentation state and reset fragmentation buffer length --- Modified: src/modules/websocket/ws_conn.h Modified: src/modules/websocket/ws_frame.c --- Diff: https://github.com/kamailio/kamailio/commit/8625d6ab72479afb6b92f5c9ca54265be54153db.diff Patch: https://github.com/kamailio/kamailio/commit/8625d6ab72479afb6b92f5c9ca54265be54153db.patch --- diff --git a/src/modules/websocket/ws_conn.h b/src/modules/websocket/ws_conn.h index a67dea7c3a0..288fef6a67b 100644 --- a/src/modules/websocket/ws_conn.h +++ b/src/modules/websocket/ws_conn.h @@ -91,6 +91,7 @@ typedef struct ws_connection ws_send_item_t *sendq_head; ws_send_item_t *sendq_tail; + int frag_progress; str frag_buf; } ws_connection_t; diff --git a/src/modules/websocket/ws_frame.c b/src/modules/websocket/ws_frame.c index 4c118d7e9f6..8e3c0b9c826 100644 --- a/src/modules/websocket/ws_frame.c +++ b/src/modules/websocket/ws_frame.c @@ -626,6 +626,15 @@ int ws_frame_receive(sr_event_param_t *evp) switch(opcode) { case OPCODE_CONTINUATION: if(likely(frame.wsc->sub_protocol == SUB_PROTOCOL_SIP)) { + if(frame.wsc->frag_progress == 0) { + LM_WARN("received continuation frame without fragmented " + "message in progress\n"); + if(close_connection(&frame.wsc, LOCAL_CLOSE, 1002, + str_status_protocol_error) + < 0) + LM_ERR("closing connection\n"); + return -1; + } if(frame.wsc->frag_buf.len + frame.payload_len >= BUF_SIZE) { LM_ERR("Buffer overflow assembling websocket fragments %d " "+ %d = %d\n", @@ -642,6 +651,8 @@ int ws_frame_receive(sr_event_param_t *evp) if(frame.fin) { ret = receive_msg(frame.wsc->frag_buf.s, frame.wsc->frag_buf.len, tcpinfo->rcv); + frame.wsc->frag_buf.len = 0; + frame.wsc->frag_progress = 0; wsconn_put(frame.wsc); return ret; } @@ -655,6 +666,15 @@ int ws_frame_receive(sr_event_param_t *evp) case OPCODE_TEXT_FRAME: case OPCODE_BINARY_FRAME: if(likely(frame.wsc->sub_protocol == SUB_PROTOCOL_SIP)) { + if(frame.wsc->frag_progress != 0) { + LM_WARN("received new data frame while fragmented message " + "is still in progress\n"); + if(close_connection(&frame.wsc, LOCAL_CLOSE, 1002, + str_status_protocol_error) + < 0) + LM_ERR("closing connection\n"); + return -1; + } LM_DBG("Rx SIP (or text) message:\n%.*s\n", frame.payload_len, frame.payload_data); update_stat(ws_sip_received_frames, 1); @@ -679,6 +699,7 @@ int ws_frame_receive(sr_event_param_t *evp) memcpy(frame.wsc->frag_buf.s, frame.payload_data, frame.payload_len); frame.wsc->frag_buf.len = frame.payload_len; + frame.wsc->frag_progress = 1; frame.wsc->frag_buf.s[frame.wsc->frag_buf.len] = '\0'; wsconn_put(frame.wsc); return 0; _______________________________________________ Kamailio - Development Mailing List -- [email protected] To unsubscribe send an email to [email protected] Important: keep the mailing list in the recipients, do not reply only to the sender!
