diff --git a/jetty-websocket/websocket-core/src/main/java/org/eclipse/jetty/websocket/generator/FrameGenerator.java b/jetty-websocket/websocket-core/src/main/java/org/eclipse/jetty/websocket/generator/FrameGenerator.java index 34f34d066f2..c10bf537117 100644 --- a/jetty-websocket/websocket-core/src/main/java/org/eclipse/jetty/websocket/generator/FrameGenerator.java +++ b/jetty-websocket/websocket-core/src/main/java/org/eclipse/jetty/websocket/generator/FrameGenerator.java @@ -5,6 +5,7 @@ import java.nio.ByteBuffer; import org.eclipse.jetty.util.log.Log; import org.eclipse.jetty.util.log.Logger; import org.eclipse.jetty.websocket.api.PolicyViolationException; +import org.eclipse.jetty.websocket.api.ProtocolException; import org.eclipse.jetty.websocket.api.WebSocketPolicy; import org.eclipse.jetty.websocket.protocol.CloseInfo; import org.eclipse.jetty.websocket.protocol.OpCode; @@ -151,6 +152,14 @@ public class FrameGenerator // remember the position int positionPrePayload = buffer.position(); + if (frame.getOpCode().isControlFrame()) + { + if (frame.getPayloadLength() > 125) + { + throw new ProtocolException("Invalid control frame payload length"); + } + } + if (frame.getOpCode() == OpCode.CLOSE) { // validate the close diff --git a/jetty-websocket/websocket-core/src/main/java/org/eclipse/jetty/websocket/protocol/WebSocketFrame.java b/jetty-websocket/websocket-core/src/main/java/org/eclipse/jetty/websocket/protocol/WebSocketFrame.java index fa50d041dc1..6ee1ce73085 100644 --- a/jetty-websocket/websocket-core/src/main/java/org/eclipse/jetty/websocket/protocol/WebSocketFrame.java +++ b/jetty-websocket/websocket-core/src/main/java/org/eclipse/jetty/websocket/protocol/WebSocketFrame.java @@ -1,8 +1,8 @@ package org.eclipse.jetty.websocket.protocol; -import javax.xml.ws.ProtocolException; import org.eclipse.jetty.util.StringUtil; +import org.eclipse.jetty.websocket.api.ProtocolException; /** * A Base Frame as seen in RFC 6455. Sec 5.2 diff --git a/jetty-websocket/websocket-core/src/test/java/org/eclipse/jetty/websocket/ab/TestABCase7_3.java b/jetty-websocket/websocket-core/src/test/java/org/eclipse/jetty/websocket/ab/TestABCase7_3.java index 22f93a1b10f..7cb9c7fed15 100644 --- a/jetty-websocket/websocket-core/src/test/java/org/eclipse/jetty/websocket/ab/TestABCase7_3.java +++ b/jetty-websocket/websocket-core/src/test/java/org/eclipse/jetty/websocket/ab/TestABCase7_3.java @@ -4,6 +4,7 @@ import static org.hamcrest.Matchers.is; import java.nio.ByteBuffer; +import org.eclipse.jetty.util.BufferUtil; import org.eclipse.jetty.websocket.ByteBufferAssert; import org.eclipse.jetty.websocket.api.ProtocolException; import org.eclipse.jetty.websocket.api.WebSocketBehavior; @@ -287,7 +288,16 @@ public class TestABCase7_3 byte[] messageBytes = message.toString().getBytes(); - WebSocketFrame closeFrame = FrameBuilder.close(1000,message.toString()).asFrame(); + WebSocketFrame closeFrame = FrameBuilder.close().asFrame(); + + ByteBuffer bb = ByteBuffer.allocate(WebSocketFrame.MAX_CONTROL_PAYLOAD + 1); // 126 which is too big for control + + bb.putChar((char)1000); + bb.put(messageBytes); + + BufferUtil.flipToFlush(bb,0); + + closeFrame.setPayload(BufferUtil.toArray(bb)); Generator generator = new Generator(policy); ByteBuffer actual = ByteBuffer.allocate(32); @@ -295,7 +305,7 @@ public class TestABCase7_3 } @Test - public void testCase7_3_6ParseCloseWithStatusMaxReason() + public void testCase7_3_6ParseCloseWithInvalidStatusReason() { StringBuilder message = new StringBuilder(); for ( int i = 0 ; i < 124 ; ++i )