Websocket: Fix max_inflate_size calculation

Author: essen

src/cowboy_websocket.erl

@@ -312,7 +312,7 @@ websocket_handshake(State=#state{opts=Opts},
 	mask_key :: cow_ws:mask_key(),
 	rsv :: cow_ws:rsv(),
 	close_code = undefined :: undefined | cow_ws:close_code(),
-	unmasked = <<>> :: binary(),
+	payload = <<>> :: binary(),
 	unmasked_len = 0 :: non_neg_integer(),
 	buffer = <<>> :: binary()
 }).
@@ -540,37 +540,37 @@ parse_header(State=#state{opts=Opts, frag_state=FragState, extensions=Extensions
 parse_payload(State=#state{opts=Opts, frag_state=FragState, utf8_state=Incomplete, extensions=Extensions},
 		HandlerState, ParseState=#ps_payload{
 			type=Type, len=Len, mask_key=MaskKey, rsv=Rsv,
-			unmasked=Unmasked, unmasked_len=UnmaskedLen}, Data) ->
+			payload=Payload0, unmasked_len=UnmaskedLen}, Data) ->
 	MaxFrameSize = case maps:get(max_frame_size, Opts, ?MAX_FRAME_SIZE_DEFAULT) of
 		infinity -> infinity;
-		MaxFrameSize0 -> MaxFrameSize0 - UnmaskedLen
+		MaxFrameSize0 -> MaxFrameSize0 - byte_size(Payload0)
 	end,
 	case cow_ws:parse_payload(Data, MaskKey, Incomplete, UnmaskedLen,
 			Type, Len, FragState, Extensions#{max_inflate_size => MaxFrameSize}, Rsv) of
 		{ok, CloseCode, Payload, Utf8State, Rest} ->
 			dispatch_frame(State#state{utf8_state=Utf8State}, HandlerState,
-				ParseState#ps_payload{unmasked= <<Unmasked/binary, Payload/binary>>,
+				ParseState#ps_payload{payload= <<Payload0/binary, Payload/binary>>,
 					close_code=CloseCode}, Rest);
 		{ok, Payload, Utf8State, Rest} ->
 			dispatch_frame(State#state{utf8_state=Utf8State}, HandlerState,
-				ParseState#ps_payload{unmasked= <<Unmasked/binary, Payload/binary>>},
+				ParseState#ps_payload{payload= <<Payload0/binary, Payload/binary>>},
 				Rest);
 		{more, CloseCode, Payload, Utf8State} ->
 			before_loop(State#state{utf8_state=Utf8State}, HandlerState,
 				ParseState#ps_payload{len=Len - byte_size(Data), close_code=CloseCode,
-					unmasked= <<Unmasked/binary, Payload/binary>>,
+					payload= <<Payload0/binary, Payload/binary>>,
 					unmasked_len=UnmaskedLen + byte_size(Data)});
 		{more, Payload, Utf8State} ->
 			before_loop(State#state{utf8_state=Utf8State}, HandlerState,
 				ParseState#ps_payload{len=Len - byte_size(Data),
-					unmasked= <<Unmasked/binary, Payload/binary>>,
+					payload= <<Payload0/binary, Payload/binary>>,
 					unmasked_len=UnmaskedLen + byte_size(Data)});
 		Error = {error, _Reason} ->
 			websocket_close(State, HandlerState, Error)
 	end.
 
 dispatch_frame(State=#state{opts=Opts, frag_state=FragState, frag_buffer=SoFar}, HandlerState,
-		#ps_payload{type=Type0, unmasked=Payload0, close_code=CloseCode0}, RemainingData) ->
+		#ps_payload{type=Type0, payload=Payload0, close_code=CloseCode0}, RemainingData) ->
 	MaxFrameSize = maps:get(max_frame_size, Opts, ?MAX_FRAME_SIZE_DEFAULT),
 	case cow_ws:make_frame(Type0, Payload0, CloseCode0, FragState) of
 		%% @todo Allow receiving fragments.

test/handlers/ws_max_frame_size_deflate.erl

@@ -0,0 +1,18 @@
+-module(ws_max_frame_size_deflate).
+
+-export([init/2]).
+-export([websocket_handle/2]).
+-export([websocket_info/2]).
+
+init(Req, State) ->
+	{cowboy_websocket, Req, State, #{max_frame_size => 100, compress => true}}.
+
+websocket_handle({text, Data}, State) ->
+	{[{text, Data}], State};
+websocket_handle({binary, Data}, State) ->
+	{[{binary, Data}], State};
+websocket_handle(_Frame, State) ->
+	{[], State}.
+
+websocket_info(_Info, State) ->
+	{[], State}.

test/ws_SUITE.erl

@@ -67,6 +67,7 @@ init_dispatch() ->
 			{"/ws_timeout_hibernate", ws_timeout_hibernate, []},
 			{"/ws_timeout_cancel", ws_timeout_cancel, []},
 			{"/ws_max_frame_size", ws_max_frame_size, []},
+			{"/ws_max_frame_size_deflate", ws_max_frame_size_deflate, []},
 			{"/ws_deflate_opts", ws_deflate_opts_h, []},
 			{"/ws_dont_validate_utf8", ws_dont_validate_utf8_h, []},
 			{"/ws_ping", ws_ping_h, []}
@@ -222,6 +223,46 @@ ws_deflate_max_frame_size_close(Config) ->
 	{error, closed} = gen_tcp:recv(Socket, 0, 6000),
 	ok.
 
+ws_deflate_max_frame_size_chunked_close(Config) ->
+	doc("Server closes connection when decompressed frame size exceeds "
+		"max_frame_size option, even when the compressed payload is "
+		"delivered over multiple separate TCP segments."),
+	%% max_frame_size is set to 100 bytes in ws_max_frame_size_deflate.
+	{ok, Socket, Headers} = do_handshake("/ws_max_frame_size_deflate",
+		"Sec-WebSocket-Extensions: permessage-deflate\r\n", Config),
+	{_, "permessage-deflate"} = lists:keyfind("sec-websocket-extensions", 1, Headers),
+	Mask = 16#11223344,
+	Z = zlib:open(),
+	zlib:deflateInit(Z, best_compression, deflated, -15, 8, default),
+	%% Three independently sync-flushed chunks, each decompressing to
+	%% exactly 50 bytes. After the first two (100 bytes, exactly at
+	%% max_frame_size) the server must not close yet; after the third
+	%% (150 bytes, over max_frame_size) it must close with code 1009,
+	%% regardless of the fact that each individual chunk's own wire
+	%% size (~8-10 bytes) never looks oversized by itself.
+	[Chunk1, Chunk2, Chunk3] = [iolist_to_binary(zlib:deflate(Z, <<0:400>>, sync))
+		|| _ <- lists:seq(1, 3)],
+	Chunk1Size = byte_size(Chunk1),
+	Chunk2Size = byte_size(Chunk2),
+	CompressedData0 = iolist_to_binary([Chunk1, Chunk2, Chunk3]),
+	CompressedData = binary:part(CompressedData0, 0, byte_size(CompressedData0) - 4),
+	MaskedData = do_mask(CompressedData, Mask, <<>>),
+	Len = byte_size(MaskedData),
+	true = Len < 100,
+	<< MaskedChunk1:Chunk1Size/binary, MaskedChunk2:Chunk2Size/binary,
+		MaskedChunk3/binary >> = MaskedData,
+	ok = gen_tcp:send(Socket, << 1:1, 1:1, 0:2, 1:4, 1:1, Len:7, Mask:32 >>),
+	ok = gen_tcp:send(Socket, MaskedChunk1),
+	ok = gen_tcp:send(Socket, MaskedChunk2),
+	%% 100 bytes decompressed so far: exactly at the limit, connection
+	%% must still be open.
+	{error, timeout} = gen_tcp:recv(Socket, 0, 200),
+	ok = gen_tcp:send(Socket, MaskedChunk3),
+	%% 150 bytes decompressed: over the limit, connection must close now.
+	{ok, << 1:1, 0:3, 8:4, 0:1, 2:7, 1009:16 >>} = gen_tcp:recv(Socket, 0, 6000),
+	{error, closed} = gen_tcp:recv(Socket, 0, 6000),
+	ok.
+
 ws_deflate_opts_client_context_takeover(Config) ->
 	doc("Handler is configured with client context takeover enabled."),
 	{ok, _, Headers1} = do_handshake("/ws_deflate_opts?client_context_takeover",