{"record":{"id":"a55c8cf968bbabd0","repo":"TooTallNate/Java-WebSocket","slug":"payloadsize-is-to-little","errorCode":null,"errorMessage":"Payloadsize is to little...","messagePattern":"Payloadsize is to little\\.\\.\\.","errorType":"exception","errorClass":"LimitExceededException","httpStatus":null,"severity":"error","filePath":"src/main/java/org/java_websocket/drafts/Draft_6455.java","lineNumber":659,"sourceCode":"\n  /**\n   * Check if the frame size exceeds the allowed limit\n   *\n   * @param length the current payload length\n   * @throws LimitExceededException if the payload length is to big\n   */\n  private void translateSingleFrameCheckLengthLimit(long length) throws LimitExceededException {\n    if (length > Integer.MAX_VALUE) {\n      log.trace(\"Limit exedeed: Payloadsize is to big...\");\n      throw new LimitExceededException(\"Payloadsize is to big...\");\n    }\n    if (length > maxFrameSize) {\n      log.trace(\"Payload limit reached. Allowed: {} Current: {}\", maxFrameSize, length);\n      throw new LimitExceededException(\"Payload limit reached.\", maxFrameSize);\n    }\n    if (length < 0) {\n      log.trace(\"Limit underflow: Payloadsize is to little...\");\n      throw new LimitExceededException(\"Payloadsize is to little...\");\n    }\n  }\n\n  /**\n   * Check if the max packet size is smaller than the real packet size\n   *\n   * @param maxpacketsize  the max packet size\n   * @param realpacketsize the real packet size\n   * @throws IncompleteException if the maxpacketsize is smaller than the realpackagesize\n   */\n  private void translateSingleFrameCheckPacketSize(int maxpacketsize, int realpacketsize)\n      throws IncompleteException {\n    if (maxpacketsize < realpacketsize) {\n      log.trace(\"Incomplete frame: maxpacketsize < realpacketsize\");\n      throw new IncompleteException(realpacketsize);\n    }\n  }\n","sourceCodeStart":641,"sourceCodeEnd":677,"githubUrl":"https://github.com/TooTallNate/Java-WebSocket/blob/afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d/src/main/java/org/java_websocket/drafts/Draft_6455.java#L641-L677","documentation":"translateSingleFrameCheckLengthLimit throws LimitExceededException(\"Payloadsize is to little...\") when the computed payload length is negative. Since lengths are decoded as unsigned longs, a negative value indicates an arithmetic overflow during length accumulation (e.g. adding extended length bytes overflowed).","triggerScenarios":"Overflow while accumulating payloadlength in translateSingleFrame/translateSingleFramePayloadLength (e.g. length * 256 + byte wrapping negative) produces length < 0, hitting the underflow check.","commonSituations":"Malicious or corrupt frames with adversarial 64-bit length fields; fuzzing; integer overflow in hand-rolled length parsing upstream of the check.","solutions":["Reject the connection/close with protocol error (1002) on catching LimitExceededException","Ensure the peer sends RFC-compliant frames; treat as malicious input if it persists","Update Java-WebSocket to a version where length accumulation is overflow-safe","Add input sanitization/logging at the network boundary to identify the offending peer"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n  conn.send(msg);\n} catch (LimitExceededException e) {\n  log.error(\"Payload length underflow — corrupt/malicious peer\", e);\n  conn.close(CloseFrame.PROTOCOL_ERROR, \"bad frame length\");\n}","preventionTips":["Keep Java-WebSocket updated for overflow-safe length parsing","Treat negative length indications as malicious input and drop the connection","Fuzz your endpoints to catch length-overflow paths early"],"tags":["websocket","integer-overflow","limit-exceeded","malformed-frame"],"backgroundTag":"value-out-of-range","analyzedSha":"afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d","analyzedAt":"2026-09-09T14:39:47.546Z","contentChangedAt":"2026-09-09T14:39:47.546Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}