Merge commit from fork

* tport/ws: Fix heap OOB write in WebSocket payload unmasking.

The XOR unmask loop iterated `wsh->datalen` (bytes in `wsh->buffer`:
header + payload tail) but indexed into `wsh->body`, which holds only
the per-frame payload bytes in `wsh->bbuffer`. The loop wrote up to
14 XOR'd bytes past the live payload region of `bbuffer`.

Bound the loop by `wsh->rplen` (payload bytes copied into body), which
is the correct cross-buffer count.

* tport/ws: Fix heap OOB writes from undersized WebSocket buffers

`ws_read_frame()`  and the handshake parser undersized the heap buffers
two ways, each writing past the allocation.

1. Trailing NUL. `ws_init()` and the `bbuffer` realloc sized buffers at
   exactly `buflen` / `bbuflen`, but a terminating '\0' is written at
   `buffer[datalen]` / `body[rplen]`. A buffer filled to capacity put
   that NUL one byte past the chunk. Fix: reserve a NUL slot, allocating
   `buflen + 1` / `bbuflen + 1` at init and on realloc.

2. Body undersized on the fragmentation path. The `bbuffer` grow check
   sized on the bytes still to read, not the full frame payload. Payload
   bytes arriving with the header in the initial read are copied in
   separately, so the body holds the whole `plen` at offset `blen`; the
   buffer was under-allocated by those bytes, letting a fragmented
   message write past the allocation. Fix: size on `blen + plen` (prior
   fragments plus this frame's full payload).

Author: morbit85

libsofia-sip-ua/tport/ws.c

@@ -740,8 +740,9 @@ int ws_init(wsh_t *wsh, ws_socket_t sock, SSL_CTX *ssl_ctx, int close_sock, int
 	wsh->buflen = 1024 * 64;
 	wsh->bbuflen = wsh->buflen;
 
-	wsh->buffer = malloc(wsh->buflen);
-	wsh->bbuffer = malloc(wsh->bbuflen);
+	/* +1 NUL slot — see wsh_t in ws.h. */
+	wsh->buffer = malloc(wsh->buflen + 1);
+	wsh->bbuffer = malloc(wsh->bbuflen + 1);
 	//printf("init %p %ld\n", (void *) wsh->bbuffer, wsh->bbuflen);
 	//memset(wsh->buffer, 0, wsh->buflen);
 	//memset(wsh->bbuffer, 0, wsh->bbuflen);
@@ -1043,18 +1044,21 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
 
 			blen = wsh->body - wsh->bbuffer;
 
-			if (need + blen > (ssize_t)wsh->bbuflen) {
+			/* Body must hold blen accumulated bytes plus this frame's
+			 * full payload. */
+			if (blen + wsh->plen > (ssize_t)wsh->bbuflen) {
 				void *tmp;
 
-				wsh->bbuflen = need + blen + wsh->rplen;
+				wsh->bbuflen = blen + wsh->plen;
 
 				if (wsh->payload_size_max && wsh->bbuflen > wsh->payload_size_max) {
 					/* size limit */
 					*oc = WSOC_CLOSE;
 					return ws_close(wsh, WS_NONE);
 				}
 
-				if ((tmp = realloc(wsh->bbuffer, wsh->bbuflen))) {
+				/* +1 NUL slot — see wsh_t in ws.h. */
+				if ((tmp = realloc(wsh->bbuffer, wsh->bbuflen + 1))) {
 					wsh->bbuffer = tmp;
 				} else {
 					abort();
@@ -1086,7 +1090,9 @@ ssize_t ws_read_frame(wsh_t *wsh, ws_opcode_t *oc, uint8_t **data)
 			if (mask && maskp) {
 				ssize_t i;
 
-				for (i = 0; i < wsh->datalen; i++) {
+				/* Unmask payload only. wsh->datalen tracks bytes in wsh->buffer
+				 * (header + frame), but wsh->body holds just the rplen payload bytes.*/
+				for (i = 0; i < wsh->rplen; i++) {
 					wsh->body[i] ^= maskp[i % 4];
 				}
 			}

libsofia-sip-ua/tport/ws.h

@@ -92,6 +92,9 @@ typedef enum {
 
 typedef struct wsh_s {
 	ws_socket_t sock;
+	/* buffer/bbuffer are allocated as buflen+1 / bbuflen+1; the trailing
+	 * byte is reserved as a NUL terminator slot. buflen/bbuflen track
+	 * usable content length, not allocation size. */
 	char *buffer;
 	char *bbuffer;
 	char *body;