From d964f58c54132d3563993017212ad9c01101e587 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 18 Jun 2026 17:12:22 +0000 Subject: [PATCH 1/6] Bump actions/checkout from 6 to 7 Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/check-arduino.yml | 2 +- .github/workflows/compile-examples.yml | 2 +- .github/workflows/spell-check.yml | 2 +- .github/workflows/sync-labels.yml | 4 ++-- 4 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/check-arduino.yml b/.github/workflows/check-arduino.yml index 97b2bf2..452a94f 100644 --- a/.github/workflows/check-arduino.yml +++ b/.github/workflows/check-arduino.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Arduino Lint uses: arduino/arduino-lint-action@v2 diff --git a/.github/workflows/compile-examples.yml b/.github/workflows/compile-examples.yml index 4f210b7..005d046 100644 --- a/.github/workflows/compile-examples.yml +++ b/.github/workflows/compile-examples.yml @@ -38,7 +38,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Compile examples uses: arduino/compile-sketches@v1 diff --git a/.github/workflows/spell-check.yml b/.github/workflows/spell-check.yml index 8fc4b8c..8717032 100644 --- a/.github/workflows/spell-check.yml +++ b/.github/workflows/spell-check.yml @@ -16,7 +16,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Spell check uses: codespell-project/actions-codespell@master diff --git a/.github/workflows/sync-labels.yml b/.github/workflows/sync-labels.yml index c549f37..83615bc 100644 --- a/.github/workflows/sync-labels.yml +++ b/.github/workflows/sync-labels.yml @@ -27,7 +27,7 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Download JSON schema for labels configuration file id: download-schema @@ -105,7 +105,7 @@ jobs: echo "::set-output name=flag::--dry-run" - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@v7 - name: Download configuration files artifact uses: actions/download-artifact@v8 From d4274ebb56d7cc45619e9a1f852661cab598fad4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 2 Jul 2026 17:12:17 +0000 Subject: [PATCH 2/6] Bump arduino/arduino-lint-action from 2 to 3 Bumps [arduino/arduino-lint-action](https://github.com/arduino/arduino-lint-action) from 2 to 3. - [Release notes](https://github.com/arduino/arduino-lint-action/releases) - [Commits](https://github.com/arduino/arduino-lint-action/compare/v2...v3) --- updated-dependencies: - dependency-name: arduino/arduino-lint-action dependency-version: '3' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- .github/workflows/check-arduino.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/check-arduino.yml b/.github/workflows/check-arduino.yml index 452a94f..be200da 100644 --- a/.github/workflows/check-arduino.yml +++ b/.github/workflows/check-arduino.yml @@ -19,7 +19,7 @@ jobs: uses: actions/checkout@v7 - name: Arduino Lint - uses: arduino/arduino-lint-action@v2 + uses: arduino/arduino-lint-action@v3 with: compliance: specification library-manager: update From af935ce9df346f1d2ea94c1529a7f8f5577a82e7 Mon Sep 17 00:00:00 2001 From: pennam Date: Mon, 13 Jul 2026 12:34:35 +0200 Subject: [PATCH 3/6] Fix typo in WebSocketClient::write buffer size clamp Use sizeof(iTxBuffer) instead of sizeof(iTxSize) when computing the remaining space, preventing truncated writes and potential memcpy overflow. --- src/WebSocketClient.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/WebSocketClient.cpp b/src/WebSocketClient.cpp index ab41b0a..7edc502 100644 --- a/src/WebSocketClient.cpp +++ b/src/WebSocketClient.cpp @@ -167,7 +167,7 @@ size_t WebSocketClient::write(const uint8_t *aBuffer, size_t aSize) // check if the write size, fits in the buffer if ((iTxSize + aSize) > sizeof(iTxBuffer)) { - aSize = sizeof(iTxSize) - iTxSize; + aSize = sizeof(iTxBuffer) - iTxSize; } // copy data into the buffer From eed84b6cd6f7eca3fc5bf2ed6e2c3c48a25f63c8 Mon Sep 17 00:00:00 2001 From: pennam Date: Mon, 13 Jul 2026 15:50:01 +0200 Subject: [PATCH 4/6] WebSocketClient: fix undefined read order in frame length Multiple read() calls in one expression have unspecified evaluation order in C++, so the length bytes could be combined wrong. Read each byte into its own variable before combining them. --- src/WebSocketClient.cpp | 30 +++++++++++++++++++++--------- 1 file changed, 21 insertions(+), 9 deletions(-) diff --git a/src/WebSocketClient.cpp b/src/WebSocketClient.cpp index ab41b0a..437748d 100644 --- a/src/WebSocketClient.cpp +++ b/src/WebSocketClient.cpp @@ -213,18 +213,30 @@ int WebSocketClient::parseMessage() } else if (length == 126) { - iRxSize = (HttpClient::read() << 8) | HttpClient::read(); + // read each byte in a well-defined order (the evaluation order of + // multiple read() calls in a single expression is unspecified) + uint8_t b1 = HttpClient::read(); + uint8_t b0 = HttpClient::read(); + iRxSize = ((uint64_t)b1 << 8) | b0; } else { - iRxSize = ((uint64_t)HttpClient::read() << 56) | - ((uint64_t)HttpClient::read() << 48) | - ((uint64_t)HttpClient::read() << 40) | - ((uint64_t)HttpClient::read() << 32) | - ((uint64_t)HttpClient::read() << 24) | - ((uint64_t)HttpClient::read() << 16) | - ((uint64_t)HttpClient::read() << 8) | - (uint64_t)HttpClient::read(); + uint8_t b7 = HttpClient::read(); + uint8_t b6 = HttpClient::read(); + uint8_t b5 = HttpClient::read(); + uint8_t b4 = HttpClient::read(); + uint8_t b3 = HttpClient::read(); + uint8_t b2 = HttpClient::read(); + uint8_t b1 = HttpClient::read(); + uint8_t b0 = HttpClient::read(); + iRxSize = ((uint64_t)b7 << 56) | + ((uint64_t)b6 << 48) | + ((uint64_t)b5 << 40) | + ((uint64_t)b4 << 32) | + ((uint64_t)b3 << 24) | + ((uint64_t)b2 << 16) | + ((uint64_t)b1 << 8) | + (uint64_t)b0; } // read in the mask, if present From 532b516b73857dadd972bb464f96590821b64acd Mon Sep 17 00:00:00 2001 From: pennam Date: Mon, 13 Jul 2026 15:50:15 +0200 Subject: [PATCH 5/6] WebSocketClient: simplify RX size branching Default iRxSize to the inline length and only override it for the 126/127 extended-length cases. No behavioural change. --- src/WebSocketClient.cpp | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/src/WebSocketClient.cpp b/src/WebSocketClient.cpp index 437748d..f7c1ddc 100644 --- a/src/WebSocketClient.cpp +++ b/src/WebSocketClient.cpp @@ -207,11 +207,8 @@ int WebSocketClient::parseMessage() length &= 0x7f; // read the RX size - if (length < 126) - { - iRxSize = length; - } - else if (length == 126) + iRxSize = length; + if (length == 126) { // read each byte in a well-defined order (the evaluation order of // multiple read() calls in a single expression is unspecified) @@ -219,7 +216,7 @@ int WebSocketClient::parseMessage() uint8_t b0 = HttpClient::read(); iRxSize = ((uint64_t)b1 << 8) | b0; } - else + else if (length == 127) { uint8_t b7 = HttpClient::read(); uint8_t b6 = HttpClient::read(); From d0a757775795fa0e84dd0c6d5bfede2d5ed634e7 Mon Sep 17 00:00:00 2001 From: pennam Date: Mon, 13 Jul 2026 15:50:30 +0200 Subject: [PATCH 6/6] WebSocketClient: check extended length/mask bytes are available Only 2 header bytes were guaranteed before reading the extended length and mask, so a partial header made read() return -1 and corrupt iRxSize. Bail out until all header bytes have arrived. --- src/WebSocketClient.cpp | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/src/WebSocketClient.cpp b/src/WebSocketClient.cpp index f7c1ddc..e97d4a9 100644 --- a/src/WebSocketClient.cpp +++ b/src/WebSocketClient.cpp @@ -206,6 +206,26 @@ int WebSocketClient::parseMessage() iRxMasked = (length & 0x80); length &= 0x7f; + // work out how many extended length and mask bytes follow the + // initial opcode + length bytes + int extendedLength = 0; + if (length == 126) + { + extendedLength = 2; + } + else if (length == 127) + { + extendedLength = 8; + } + int maskLength = iRxMasked ? (int)sizeof(iRxMaskKey) : 0; + + // make sure the remaining header bytes are available before reading + // them, otherwise the frame header is incomplete + if (HttpClient::available() < (extendedLength + maskLength)) + { + return 0; + } + // read the RX size iRxSize = length; if (length == 126)