Re: [hybi] Framing take IV [why fragment]

[Ian Hickson <[e-mail]>]

On Wed, 4 Aug 2010, Patrick McManus wrote:
> On Wed, 2010-08-04 at 17:55 +0000, Ian Hickson wrote:
> > On Wed, 4 Aug 2010, Patrick McManus wrote:
> > > 
> > > But I also believe fragments with fixed lengths are simpler than a 
> > > BER because properly aligned lengths are always correct data - there 
> > > are no error cases as all the bits are defined to be some quantity 
> > > regardless of their arrangement. BER has error cases and determining 
> > > the expressed quantity requires multiple indirections and a 
> > > significant algorithm to use it.
> > 
> > As far as I can tell there are no error cases as defined in 
> > WebSockets.
> 
> I believe the specific ber length suggestion was:
> 
>  - a BER-encoded packed integer, most-significant-digits first, high bit 
> used to indicate a continuation byte, giving the payload length.
> 
> In that case, as I understand it, it would be an error if the ber type 
> encoding byte didn't specify a universal primitive type of 2. (or maybe 
> I'm wrong and it needs to be some other identifier - but that doesn't 
> really matter).
> 
> it is not a big deal, but it is an error case.

The spec just uses the packed integer part, not the whole ASN.1 form. 
There are no error conditions with that as far as I can tell. There's one 
redundancy (leading 0x80 bytes), but that's not an error case, and since 
the behaviour is well-defined, doesn't even seen to be a likely attack 
vector (which redundancies can often become), though naturally we'd want 
to make sure we tested that thoroughly in our test suite.

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'