| 
					
				 | 
			
			
				@@ -10971,15 +10971,16 @@ read_websocket(struct mg_connection *conn, 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 			} else { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 				mop = buf[0]; /* current mask and opcode, overwritten by 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 				               * memmove() */ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 				/* Length of the message being read at the front of the 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-				                 * queue. Cast to 31 bit is OK, since we limited 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-				 * data_len 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-				                 * before. */ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+                                 * queue. Cast to 31 bit is OK, since we limited 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+                                 * data_len before. */ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 				len = (size_t)data_len + header_len; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 				/* Copy the data payload into the data pointer for the 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-				 * callback */ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-				memcpy(data, buf + header_len, data_len); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+                                 * callback. Cast to 31 bit is OK, since we 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+                                 * limited data_len */ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+				memcpy(data, buf + header_len, (size_t)data_len); 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 				/* Move the queue forward len bytes */ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 				memmove(buf, buf + len, body_len - len); 
			 | 
		
	
	
		
			
				| 
					
				 | 
			
			
				@@ -10990,7 +10991,7 @@ read_websocket(struct mg_connection *conn, 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				  
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 			/* Apply mask if necessary */ 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 			if (mask_len > 0) { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				-				for (i = 0; i < data_len; ++i) { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				+				for (i = 0; i < (size_t)data_len; i++) { 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 					data[i] ^= mask[i & 3]; 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 				} 
			 | 
		
	
		
			
				 | 
				 | 
			
			
				 			} 
			 |