[Nashit-h]

decode_frame_hybi17 checks the announced payload length against buffer.size(), but the payload is read from it + kMaskingKeyWidthInBytes, after the iterator has already walked past the two byte header and the extended length field. A client that sends only the two header bytes of a masked frame, 0x81 0xFD, underflows buffer.size() - kMaskingKeyWidthInBytes to SIZE_MAX, passes the check, and the unmasking loop reads 125 bytes past a two byte vector; the bytes it picks up go to OnWsFrame and back out to the peer. Measuring against what is left after the header fixes both that underflow and the header bytes the old check never accounted for.

[nodejs-github-bot]

Review requested:

• @nodejs/inspector

[Nashit-h]

gentle ping

[nodejs-github-bot]

CI: https://ci.nodejs.org/job/node-test-pull-request/76688/

[panva]

@Nashit-h please fix the linter issues, rebase and force push.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.69%. Comparing base (d44625a) to head (c0ef71e).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #64618      +/-   ##
==========================================
- Coverage   90.69%   90.69%   -0.01%     
==========================================
  Files         797      797              
  Lines      278787   278788       +1     
  Branches    53607    53609       +2     
==========================================
- Hits       252858   252836      -22     
- Misses      16292    16300       +8     
- Partials     9637     9652      +15     

Files with missing lines	Coverage Δ
src/inspector_socket.cc	82.90% <100.00%> (+0.04%)	⬆️

... and 30 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cola119]

lgtm when the formatter error is fixed

[Nashit-h]

Done. Rebased on main, squashed the two commits into one, and applied the clang-format reflow on the FRAME_BODY initializer that format-cpp was asking for. No code changes beyond that line wrap.