From e19d63f41f3bfdf8a48396a23c9f66ba4cca5a61 Mon Sep 17 00:00:00 2001
From: dylan <331506+macdylan@users.noreply.github.com>
Date: Sun, 20 Sep 2026 00:23:47 +0800
Subject: [PATCH] fix(ws): guard _onData against a torn 2-byte frame header

When a single TCP delivery ends on exactly one byte of the next frame's
header, the STATE_FRAME_START branch reads fdata[1] out of bounds and
computes plen -= 2 on plen == 1, underflowing size_t to SIZE_MAX; the
parser then walks wild memory until the device panics.

The v3.12 websocket refactor (#462) added careful torn-frame handling
for the mask bytes and the payload, but the base 2-byte header consume
is still only guarded by 'while (plen > 0)'.

Drop the un-parseable tail instead of crashing: the connection
desynchronizes and is closed by the client, the same trade-off the
adjacent extended-length guards already make.
---
 src/AsyncWebSocket.cpp | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/AsyncWebSocket.cpp b/src/AsyncWebSocket.cpp
index 7e1d9e9f..89a5dcf4 100644
--- a/src/AsyncWebSocket.cpp
+++ b/src/AsyncWebSocket.cpp
@@ -516,6 +516,8 @@ void AsyncWebSocketClient::_onData(void *pbuf, size_t plen) {
     );
 
     if (_pstate == STATE_FRAME_START) {
+      if (plen < 2) break;  // torn base header: the delivery ends inside the 2 header bytes
+
       const uint8_t *fdata = data;
 
       _pinfo.index = 0;