websocket: handle non-zero opcode on continuous frame

If a connection have continuous frame, the next frame opcode must be 0
or it will be considering invalid frame and server will close the
connection.

1 files changed, 6 insertions, 0 deletions

diff --git a/lib/websocket/server.go b/lib/websocket/server.go
index aa45aa5c..f4936216 100644
--- a/lib/websocket/server.go
+++ b/lib/websocket/server.go
@@ -442,6 +442,12 @@ func (serv *Server) handleFragment(conn int, req *Frame) (isInvalid bool) {
 	if frame == nil {
 		frame = req
 	} else {
+		// If a connection have continuous frame, the next frame
+		// opcode must be 0.
+		if req.opcode != opcodeCont {
+			return true
+		}
+
 		frame.payload = append(frame.payload, req.payload...)
 		if req.len > 0 {
 			frame.len += req.len