Subject: [hybi] Unbounded buffers in -76 handshake

From: Joe Mason <[email-masked]>
Date: Wed, 5 Jan 2011 14:50:33 -0500

I know the -76 handshake is obsolete, but I'm trying to close off a simple bug in the existing WebKit implementation.

According to http://tools.ietf.org/html/draft-hixie-thewebsocketprotocol-76#section-4.1, step 28, the client must:

	Read bytes from the server until either the connection closes, or a 0x0A byte is read. Let /field/ be 
	these bytes, including the 0x0A byte.

This means a server can easily run a client out of memory by sending an unbounded string of bytes with no 0x0A.  The client is, by a strict reading, required to buffer all bytes received.  (Actually it's simple to code an equivalent algorithm that only starts buffering after receiving 0x20, and buffers at most 3 bytes, but let's stick with the algorithm as stated.)

The easy fix is to suggest a max buffer length.  (The spec already says, "User agents may apply a timeout to this step, failing the WebSocket connection if the server does not send back data in a suitable time period."  A maximum number of bytes to read is a logical extension.)  What would be a good value for the max length?  Is this worth adding to the spec as a quick fix while we're still discussing the updated handshake?

Joe

---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.