{"record":{"id":"2b084a6f51aa6304","repo":"TooTallNate/Java-WebSocket","slug":"payloadsize-is-to-big","errorCode":null,"errorMessage":"Payloadsize is to big...","messagePattern":"Payloadsize is to big\\.\\.\\.","errorType":"exception","errorClass":"LimitExceededException","httpStatus":null,"severity":"error","filePath":"src/main/java/org/java_websocket/drafts/Draft_6455.java","lineNumber":651,"sourceCode":"        bytes[i] = buffer.get(/*1 + i*/);\n      }\n      long length = new BigInteger(bytes).longValue();\n      translateSingleFrameCheckLengthLimit(length);\n      payloadlength = (int) length;\n    }\n    return new TranslatedPayloadMetaData(payloadlength, realpacketsize);\n  }\n\n  /**\n   * Check if the frame size exceeds the allowed limit\n   *\n   * @param length the current payload length\n   * @throws LimitExceededException if the payload length is to big\n   */\n  private void translateSingleFrameCheckLengthLimit(long length) throws LimitExceededException {\n    if (length > Integer.MAX_VALUE) {\n      log.trace(\"Limit exedeed: Payloadsize is to big...\");\n      throw new LimitExceededException(\"Payloadsize is to big...\");\n    }\n    if (length > maxFrameSize) {\n      log.trace(\"Payload limit reached. Allowed: {} Current: {}\", maxFrameSize, length);\n      throw new LimitExceededException(\"Payload limit reached.\", maxFrameSize);\n    }\n    if (length < 0) {\n      log.trace(\"Limit underflow: Payloadsize is to little...\");\n      throw new LimitExceededException(\"Payloadsize is to little...\");\n    }\n  }\n\n  /**\n   * Check if the max packet size is smaller than the real packet size\n   *\n   * @param maxpacketsize  the max packet size\n   * @param realpacketsize the real packet size\n   * @throws IncompleteException if the maxpacketsize is smaller than the realpackagesize\n   */","sourceCodeStart":633,"sourceCodeEnd":669,"githubUrl":"https://github.com/TooTallNate/Java-WebSocket/blob/afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d/src/main/java/org/java_websocket/drafts/Draft_6455.java#L633-L669","documentation":"translateSingleFrameCheckLengthLimit throws LimitExceededException(\"Payloadsize is to big...\") when a frame's decoded payload length exceeds Integer.MAX_VALUE. JavaWebsocket stores payloads in byte arrays/ByteBuffers, which cannot exceed the int range, so such frames cannot be handled.","triggerScenarios":"An incoming frame uses a 64-bit extended payload length whose value is > 2147483647; translateSingleFrame or translateSingleFramePayloadLength calls translateSingleFrameCheckLengthLimit and the length > Integer.MAX_VALUE branch fires.","commonSituations":"Malicious or broken peer announcing absurdly large frames; memory-corrupted length fields; fuzzer-generated traffic; attempting to receive multi-gigabyte single frames.","solutions":["Catch LimitExceededException and close the connection with a message-too-big / policy-violation close code (1009)","Cap frame sizes at the sender so no single frame exceeds Integer.MAX_VALUE (and your maxFrameSize)","Split large messages into multiple frames or use message size limits on both endpoints","Treat it as untrusted input: validate peer frame sizes before accepting"],"exampleFix":"// before: no size guard, exception surfaces as connect loss\n// after: configure and handle\nDraft_6455 draft = new Draft_6455();\ndraft.setMaxFrameSize(1024 * 1024); // 1 MiB cap\n// in listener:\n} catch (LimitExceededException e) {\n  webSocket.close(CloseFrame.TOOBIG, \"frame too large\");\n}","handlingStrategy":"try-catch","validationCode":"// reject impossible 64-bit lengths before the library does\nlong declaredLen = readFrameLength(header);\nif (declaredLen > Integer.MAX_VALUE) failConnection(CloseFrame.TOOBIG);","typeGuard":null,"tryCatchPattern":"try {\n  startConnection();\n} catch (LimitExceededException e) {\n  webSocket.close(CloseFrame.TOOBIG, \"frame too large\");\n}","preventionTips":["Set an explicit maxFrameSize well below Integer.MAX_VALUE","Treat huge declared lengths from untrusted peers as an attack signal","Keep single frames small; fragment large messages"],"tags":["websocket","payload-size","limit-exceeded","int-overflow"],"backgroundTag":"payload-too-large","analyzedSha":"afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d","analyzedAt":"2026-09-09T14:39:47.546Z","contentChangedAt":"2026-09-09T14:39:47.546Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}