Merge commit from fork

`ws_read_frame()` sizes `wsh->bbuffer` from the length declared in each
frame header, so that length needs a bound that holds for every library
consumer and across the fragments of one message. The receive adapter
then has to hand the message to the parser with the length it actually
transferred, which is what lets the SIP layer decide the outcome for an
oversized message rather than the transport deciding for it.

`libsofia-sip-ua/tport/ws.c`:

- `ws_global_payload_size_max` defaults to `WS_PAYLOAD_SIZE_MAX_DEFAULT`
  (4 MiB) instead of `0`, so the cap applies without a call to
  `ws_set_global_payload_size_max()`. The cap bounds what one message can
  make this layer allocate, not what size a message may be: keeping it
  above NTA's 2 MiB `sa_maxsize` leaves the size limit with the SIP layer,
  which can answer 413, and reserves the cap for cutting off anything
  beyond that.
- `ws_set_global_payload_size_max()` maps a non-positive argument to the
  default. Once the check below runs unconditionally there is no value
  left that means unlimited: `0` would reject every non-empty frame. A
  caller passing `0` to mean unlimited gets the default instead.
- The 64-bit length form is bounded against the cap while still
  `uint64_t`, then narrowed. Passing that test makes the assignment to
  `wsh->plen` exact even where `ssize_t` is 32 bits, and it enforces the
  RFC 6455 5.2 rule that the top bit of that form be 0.
- The accumulated length is checked once the frame header is decoded, on
  every frame, rather than inside the branch that grows `wsh->bbuffer`.
  The decision no longer depends on `blen + wsh->plen`, the sum it is
  there to bound, and comparing against the cap by subtraction keeps that
  sum in range for the sizing arithmetic that follows.
- `blen` becomes `ssize_t`, matching the `wsh->body - wsh->bbuffer`
  difference it holds.

`libsofia-sip-ua/tport/tport_type_ws.c`:

- `tport_recv_stream_ws()` commits the number of bytes it copied into the
  message rather than the number the frame held. The two differ when the
  message exceeds `sa_maxsize`: `tport_recv_iovec()` then provisions a
  short buffer so the parser still receives a prefix. The assertion after
  the copy loop is relaxed to match, and the message reaches the parser
  flagged `MSG_FLG_TOOLARGE`, which the transaction layer answers with
  413.

Author: morbit85

libsofia-sip-ua/tport/tport_type_ws.c

@@ -242,19 +242,23 @@ int tport_recv_stream_ws(tport_t *self)
   msg_set_address(msg, self->tp_addr, self->tp_addrlen);
 
   for (i = 0, n = 0; i < veclen; i++) {
-    m = iovec[i].mv_len; assert(N >= n + m);
+    m = iovec[i].mv_len;
+    assert(N >= n + m);
+
     memcpy(iovec[i].mv_base, data + n, m);
     n += m;
   }
 
-  assert(N == n);
+  assert(n <= N);
 
   /* Write the received data to the message dump file */
   if (self->tp_master->mr_dump_file)
 	  tport_dump_iovec(self, msg, n, iovec, veclen, "recv", "from");
 
-  /* Mark buffer as used */
-  msg_recv_commit(msg, N, 0);
+  /* Mark buffer as used. The provisioned buffer is shorter than the frame
+   * when the message exceeds its size limit: the parser gets a prefix,
+   * flags it, and the reply path answers 413. */
+  msg_recv_commit(msg, n, 0);
 
   return 1;
 }

libsofia-sip-ua/tport/ws.c

@@ -29,8 +29,14 @@
 #define WS_WRITE_SANITY 200
 
 #define SHA1_HASH_SIZE 20
+
+/* Caps a whole message, not one frame. A backstop on how much a peer can
+ * make this layer allocate; the message size policy belongs to the SIP
+ * layer, so keep this above NTA's 2 MiB sa_maxsize default. */
+#define WS_PAYLOAD_SIZE_MAX_DEFAULT (4 * 1024 * 1024)
+
 static struct ws_globals_s ws_globals;
-ssize_t ws_global_payload_size_max = 0;
+ssize_t ws_global_payload_size_max = WS_PAYLOAD_SIZE_MAX_DEFAULT;
 
 #ifndef WSS_STANDALONE
 
@@ -713,9 +719,14 @@ int establish_logical_layer(wsh_t *wsh)
 	return 0;
 }
 
+/* The cap is what bounds a peer-driven allocation, so it cannot be turned
+ * off: a non-positive limit falls back to the default. Applies to handles
+ * created after this call. A consumer that raises NTA's sa_maxsize above the
+ * cap has to raise the cap too, otherwise a message sized between the two is
+ * dropped here instead of reaching the SIP layer. */
 void ws_set_global_payload_size_max(ssize_t bytes)
 {
-	ws_global_payload_size_max = bytes;
+	ws_global_payload_size_max = bytes > 0 ? bytes : WS_PAYLOAD_SIZE_MAX_DEFAULT;
 }
 
 int ws_init(wsh_t *wsh, ws_socket_t sock, SSL_CTX *ssl_ctx, int close_sock, int block, int stay_open)
@@ -911,7 +922,7 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
 	char *maskp;
 	int ll = 0;
 	int frag = 0;
-	int blen;
+	ssize_t blen;
 
 	wsh->body = wsh->bbuffer;
 	wsh->packetlen = 0;
@@ -994,7 +1005,7 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
 			wsh->payload = &wsh->buffer[2];
 
 			if (wsh->plen == 127) {
-				uint64_t *u64;
+				uint64_t len;
 
 				need += 8;
 
@@ -1007,9 +1018,19 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
 					}
 				}
 
-				u64 = (uint64_t *) wsh->payload;
+				len = ntoh64(*(uint64_t *) wsh->payload);
 				wsh->payload += 8;
-				wsh->plen = ntoh64(*u64);
+
+				/* Bound it while still unsigned: the cap is an ssize_t, so
+				 * passing this makes the assignment below exact even where
+				 * ssize_t is 32 bits. Subsumes RFC 6455 5.2's top-bit rule. */
+				if (len > (uint64_t)wsh->payload_size_max) {
+					/* size limit */
+					*oc = WSOC_CLOSE;
+					return ws_close(wsh, WS_NONE);
+				}
+
+				wsh->plen = (ssize_t)len;
 			} else if (wsh->plen == 126) {
 				uint16_t *u16;
 
@@ -1034,6 +1055,16 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
 				wsh->payload += 4;
 			}
 
+			blen = wsh->body - wsh->bbuffer;
+
+			/* Subtract rather than test blen + plen, the sum that must not
+			 * overflow; bounding it here keeps the sizing below overflow-free. */
+			if (wsh->plen > wsh->payload_size_max - blen) {
+				/* size limit */
+				*oc = WSOC_CLOSE;
+				return ws_close(wsh, WS_NONE);
+			}
+
 			need = (wsh->plen - (wsh->datalen - need));
 
 			if (need < 0) {
@@ -1042,21 +1073,13 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
 				return ws_close(wsh, WS_NONE);
 			}
 
-			blen = wsh->body - wsh->bbuffer;
-
 			/* Body must hold blen accumulated bytes plus this frame's
-			 * full payload. */
+			 * full payload; the cap check above bounds that sum. */
 			if (blen + wsh->plen > (ssize_t)wsh->bbuflen) {
 				void *tmp;
 
 				wsh->bbuflen = blen + wsh->plen;
 
-				if (wsh->payload_size_max && wsh->bbuflen > wsh->payload_size_max) {
-					/* size limit */
-					*oc = WSOC_CLOSE;
-					return ws_close(wsh, WS_NONE);
-				}
-
 				/* +1 NUL slot — see wsh_t in ws.h. */
 				if ((tmp = realloc(wsh->bbuffer, wsh->bbuflen + 1))) {
 					wsh->bbuffer = tmp;