Title: [101326] trunk
- Revision
- 101326
- Author
- [email protected]
- Date
- 2011-11-28 22:21:35 -0800 (Mon, 28 Nov 2011)
Log Message
WebSocket: Split Hixie76 length-prefixed frames aren't handled correctly
https://bugs.webkit.org/show_bug.cgi?id=68522
Reviewed by Kent Tamura.
Source/WebCore:
Test: http/tests/websocket/tests/hixie76/split-binary-frame-header.html
* websockets/WebSocketChannel.cpp:
(WebCore::WebSocketChannel::processFrameHixie76):
Do not consume the data if the length field is not finished.
LayoutTests:
* http/tests/websocket/tests/hixie76/split-binary-frame-header-expected.txt: Added.
* http/tests/websocket/tests/hixie76/split-binary-frame-header.html: Added.
* http/tests/websocket/tests/hixie76/split-binary-frame-header_wsh.py:
Added. Send WebSocket frames that older WebSocketChannel implementation fails to parse.
The client should not receive an empty text message.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (101325 => 101326)
--- trunk/LayoutTests/ChangeLog 2011-11-29 05:14:45 UTC (rev 101325)
+++ trunk/LayoutTests/ChangeLog 2011-11-29 06:21:35 UTC (rev 101326)
@@ -1,3 +1,16 @@
+2011-11-28 Yuta Kitamura <[email protected]>
+
+ WebSocket: Split Hixie76 length-prefixed frames aren't handled correctly
+ https://bugs.webkit.org/show_bug.cgi?id=68522
+
+ Reviewed by Kent Tamura.
+
+ * http/tests/websocket/tests/hixie76/split-binary-frame-header-expected.txt: Added.
+ * http/tests/websocket/tests/hixie76/split-binary-frame-header.html: Added.
+ * http/tests/websocket/tests/hixie76/split-binary-frame-header_wsh.py:
+ Added. Send WebSocket frames that older WebSocketChannel implementation fails to parse.
+ The client should not receive an empty text message.
+
2011-11-28 Stephen White <[email protected]>
[chromium] Fix SVG filters when running in accelerated drawing mode.
Added: trunk/LayoutTests/http/tests/websocket/tests/hixie76/split-binary-frame-header-expected.txt (0 => 101326)
--- trunk/LayoutTests/http/tests/websocket/tests/hixie76/split-binary-frame-header-expected.txt (rev 0)
+++ trunk/LayoutTests/http/tests/websocket/tests/hixie76/split-binary-frame-header-expected.txt 2011-11-29 06:21:35 UTC (rev 101326)
@@ -0,0 +1,13 @@
+WebSocket: Hixie76 binary frames should be handled correctly even if frame header is split into multiple TCP packets.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+Connected.
+Error occurred.
+Closed.
+PASS closeEvent.wasClean is true
+PASS errorCount is 1
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Added: trunk/LayoutTests/http/tests/websocket/tests/hixie76/split-binary-frame-header.html (0 => 101326)
--- trunk/LayoutTests/http/tests/websocket/tests/hixie76/split-binary-frame-header.html (rev 0)
+++ trunk/LayoutTests/http/tests/websocket/tests/hixie76/split-binary-frame-header.html 2011-11-29 06:21:35 UTC (rev 101326)
@@ -0,0 +1,47 @@
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+<div id="description"></div>
+<div id="console"></div>
+<script type="text/_javascript_">
+description("WebSocket: Hixie76 binary frames should be handled correctly even if frame header is split into multiple TCP packets.");
+
+window.jsTestIsAsync = true;
+
+var ws = new WebSocket("ws://localhost:8880/websocket/tests/hixie76/split-binary-frame-header");
+var errorCount = 0;
+
+ws._onopen_ = function()
+{
+ debug("Connected.");
+};
+
+ws._onmessage_ = function(messageEvent)
+{
+ testFailed("Should not receive message but received: \"" + messageEvent.data + "\"");
+};
+
+ws._onerror_ = function()
+{
+ debug("Error occurred.");
+ errorCount += 1;
+};
+
+var closeEvent;
+
+ws._onclose_ = function(event)
+{
+ debug("Closed.");
+ closeEvent = event;
+ shouldBeTrue("closeEvent.wasClean");
+ shouldEvaluateTo("errorCount", 1);
+
+ finishJSTest();
+};
+</script>
+<script src=""
+</body>
+</html>
Added: trunk/LayoutTests/http/tests/websocket/tests/hixie76/split-binary-frame-header_wsh.py (0 => 101326)
--- trunk/LayoutTests/http/tests/websocket/tests/hixie76/split-binary-frame-header_wsh.py (rev 0)
+++ trunk/LayoutTests/http/tests/websocket/tests/hixie76/split-binary-frame-header_wsh.py 2011-11-29 06:21:35 UTC (rev 101326)
@@ -0,0 +1,22 @@
+import time
+
+
+def web_socket_do_extra_handshake(request):
+ pass
+
+
+def web_socket_transfer_data(request):
+ # First frame (1 - 2 bytes): Zero-length binary frame with frame type 0x80.
+ # Second frame (3 - 4 bytes): Close frame.
+ data = ''
+
+ # There is a bug that WebSocketChannel incorrectly consumes the first byte of a binary frame header
+ # when it is split from the entire frame data. When this happens, the client recognizes the second and
+ # third bytes ('\x00\xff') as a valid text frame and invokes a message event (which should not happen
+ # in a valid client).
+
+ request.connection.write(data[:1])
+ time.sleep(0.5) # Wait for 500ms to make sure the first octet is sent out.
+ request.connection.write(data[1:])
+
+ raise handshake.AbortedByUserException('Abort the connection')
Modified: trunk/Source/WebCore/ChangeLog (101325 => 101326)
--- trunk/Source/WebCore/ChangeLog 2011-11-29 05:14:45 UTC (rev 101325)
+++ trunk/Source/WebCore/ChangeLog 2011-11-29 06:21:35 UTC (rev 101326)
@@ -1,3 +1,16 @@
+2011-11-28 Yuta Kitamura <[email protected]>
+
+ WebSocket: Split Hixie76 length-prefixed frames aren't handled correctly
+ https://bugs.webkit.org/show_bug.cgi?id=68522
+
+ Reviewed by Kent Tamura.
+
+ Test: http/tests/websocket/tests/hixie76/split-binary-frame-header.html
+
+ * websockets/WebSocketChannel.cpp:
+ (WebCore::WebSocketChannel::processFrameHixie76):
+ Do not consume the data if the length field is not finished.
+
2011-11-28 Stephen White <[email protected]>
[chromium] Fix SVG filters when running in accelerated drawing mode.
Modified: trunk/Source/WebCore/websockets/WebSocketChannel.cpp (101325 => 101326)
--- trunk/Source/WebCore/websockets/WebSocketChannel.cpp 2011-11-29 05:14:45 UTC (rev 101325)
+++ trunk/Source/WebCore/websockets/WebSocketChannel.cpp 2011-11-29 06:21:35 UTC (rev 101326)
@@ -759,6 +759,7 @@
if ((frameByte & 0x80) == 0x80) {
size_t length = 0;
bool errorFrame = false;
+ bool lengthFinished = false;
while (p < end) {
if (length > numeric_limits<size_t>::max() / 128) {
LOG(Network, "frame length overflow %lu", static_cast<unsigned long>(length));
@@ -781,9 +782,13 @@
}
length = newLength;
++p;
- if (!(msgByte & 0x80))
+ if (!(msgByte & 0x80)) {
+ lengthFinished = true;
break;
+ }
}
+ if (!errorFrame && !lengthFinished)
+ return false;
if (p + length < p) {
LOG(Network, "frame buffer pointer wrap %p+%lu->%p", p, static_cast<unsigned long>(length), p + length);
errorFrame = true;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
