diff --git a/lib/client-parser.c b/lib/client-parser.c index 12096a43..845e6f44 100644 --- a/lib/client-parser.c +++ b/lib/client-parser.c @@ -309,7 +309,7 @@ spill: } /* control packets can only be < 128 bytes long */ - if (wsi->u.ws.rx_user_buffer_head > 128 - 4) { + if (wsi->u.ws.rx_user_buffer_head > 128 - 3) { lwsl_parser("DROP PING payload too large\n"); goto ping_drop; } diff --git a/lib/parsers.c b/lib/parsers.c index adcdc294..ed36ecde 100644 --- a/lib/parsers.c +++ b/lib/parsers.c @@ -1025,7 +1025,7 @@ spill: } process_as_ping: /* control packets can only be < 128 bytes long */ - if (wsi->u.ws.rx_user_buffer_head > 128 - 4) { + if (wsi->u.ws.rx_user_buffer_head > 128 - 3) { lwsl_parser("DROP PING payload too large\n"); goto ping_drop; } diff --git a/lib/private-libwebsockets.h b/lib/private-libwebsockets.h index 8647919d..07fb2a1f 100644 --- a/lib/private-libwebsockets.h +++ b/lib/private-libwebsockets.h @@ -839,7 +839,7 @@ struct _lws_websocket_related { unsigned int rx_user_buffer_head; unsigned char mask_nonce[4]; /* Also used for close content... control opcode == < 128 */ - unsigned char ping_payload_buf[128 - 4 + LWS_SEND_BUFFER_PRE_PADDING]; + unsigned char ping_payload_buf[128 - 3 + LWS_SEND_BUFFER_PRE_PADDING]; unsigned char ping_payload_len; unsigned char frame_mask_index;