From 56192448a2221f518f3e959f511e1244100de600 Mon Sep 17 00:00:00 2001

From: "Daniel P. Berrange" <berrange@redhat.com>

Date: Wed, 20 Dec 2017 17:56:49 +0100

Subject: [PATCH 09/42] io: Allow empty websocket payload

RH-Author: Daniel P. Berrange <berrange@redhat.com>

Message-id: <20171220175702.29663-8-berrange@redhat.com>

Patchwork-id: 78453

O-Subject: [RHV-7.5 qemu-kvm-rhev PATCH v2 07/20] io: Allow empty websocket payload

Bugzilla: 1518649

RH-Acked-by: John Snow <jsnow@redhat.com>

RH-Acked-by: Jeffrey Cody <jcody@redhat.com>

RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>

From: Brandon Carpenter <brandon.carpenter@cypherpath.com>

Some browsers send pings/pongs with no payload, so allow empty payloads

instead of closing the connection.

Signed-off-by: Brandon Carpenter <brandon.carpenter@cypherpath.com>

Signed-off-by: Daniel P. Berrange <berrange@redhat.com>

(cherry picked from commit 3a29640e2cbae9d47b89ffaf98ed358920eb6797)

Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>

---

 io/channel-websock.c | 62 +++++++++++++++++++++++++---------------------------

 1 file changed, 30 insertions(+), 32 deletions(-)

diff --git a/io/channel-websock.c b/io/channel-websock.c

index 909d636..b19b5d9 100644

--- a/io/channel-websock.c

+++ b/io/channel-websock.c

@@ -697,44 +697,42 @@ static int qio_channel_websock_decode_payload(QIOChannelWebsock *ioc,

                                               Error **errp)

 {

     size_t i;

-    size_t payload_len;

+    size_t payload_len = 0;

     uint32_t *payload32;

-    if (!ioc->payload_remain) {

-        error_setg(errp,

-                   "Decoding payload but no bytes of payload remain");

-        return -1;

-    }

-

-    /* If we aren't at the end of the payload, then drop

-     * off the last bytes, so we're always multiple of 4

-     * for purpose of unmasking, except at end of payload

-     */

-    if (ioc->encinput.offset < ioc->payload_remain) {

-        payload_len = ioc->encinput.offset - (ioc->encinput.offset % 4);

-    } else {

-        payload_len = ioc->payload_remain;

-    }

-    if (payload_len == 0) {

-        return QIO_CHANNEL_ERR_BLOCK;

-    }

+    if (ioc->payload_remain) {

+        /* If we aren't at the end of the payload, then drop

+         * off the last bytes, so we're always multiple of 4

+         * for purpose of unmasking, except at end of payload

+         */

+        if (ioc->encinput.offset < ioc->payload_remain) {

+            payload_len = ioc->encinput.offset - (ioc->encinput.offset % 4);

+        } else {

+            payload_len = ioc->payload_remain;

+        }

+        if (payload_len == 0) {

+            return QIO_CHANNEL_ERR_BLOCK;

+        }

-    ioc->payload_remain -= payload_len;

+        ioc->payload_remain -= payload_len;

-    /* unmask frame */

-    /* process 1 frame (32 bit op) */

-    payload32 = (uint32_t *)ioc->encinput.buffer;

-    for (i = 0; i < payload_len / 4; i++) {

-        payload32[i] ^= ioc->mask.u;

-    }

-    /* process the remaining bytes (if any) */

-    for (i *= 4; i < payload_len; i++) {

-        ioc->encinput.buffer[i] ^= ioc->mask.c[i % 4];

+        /* unmask frame */

+        /* process 1 frame (32 bit op) */

+        payload32 = (uint32_t *)ioc->encinput.buffer;

+        for (i = 0; i < payload_len / 4; i++) {

+            payload32[i] ^= ioc->mask.u;

+        }

+        /* process the remaining bytes (if any) */

+        for (i *= 4; i < payload_len; i++) {

+            ioc->encinput.buffer[i] ^= ioc->mask.c[i % 4];

+        }

     }

-    buffer_reserve(&ioc->rawinput, payload_len);

-    buffer_append(&ioc->rawinput, ioc->encinput.buffer, payload_len);

-    buffer_advance(&ioc->encinput, payload_len);

+    if (payload_len) {

+        buffer_reserve(&ioc->rawinput, payload_len);

+        buffer_append(&ioc->rawinput, ioc->encinput.buffer, payload_len);

+        buffer_advance(&ioc->encinput, payload_len);

+    }

     return 0;

 }

-- 

1.8.3.1