From 515cec3d0b60626b71df8eca2d1a4eb269ace439 Mon Sep 17 00:00:00 2001
From: Oskar Eichler <62393985+OskarEichler@users.noreply.github.com>
Date: Sun, 30 Aug 2026 04:50:43 +0200
Subject: [PATCH] Reject invalid extended frame lengths

---
 lib/websocket/driver/hybi.rb | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/websocket/driver/hybi.rb b/lib/websocket/driver/hybi.rb
index 3487c4a..9650a70 100644
--- a/lib/websocket/driver/hybi.rb
+++ b/lib/websocket/driver/hybi.rb
@@ -328,6 +328,15 @@ def parse_extended_length(buffer)
         @frame.length = buffer.unpack(PACK_FORMATS[buffer.bytesize]).first
         @stage = @frame.masked ? 3 : 4
 
+        if (buffer.bytesize == 2 && @frame.length < 126) ||
+           (buffer.bytesize == 8 && @frame.length < 65_536)
+          return fail(:protocol_error, 'Received frame with non-minimal length encoding')
+        end
+
+        if buffer.bytesize == 8 && (buffer.getbyte(0) & MASK) == MASK
+          return fail(:protocol_error, 'Received frame with invalid 64-bit length')
+        end
+
         unless MESSAGE_OPCODES.include?(@frame.opcode) or @frame.length <= 125
           return fail(:protocol_error, "Received control frame having too long payload: #{ @frame.length }")
         end