fix(discord,gateway): inbound WS buffer overflow and WebChat drop

[cursor]

Summary

Two inbound WebSocket buffer bugs: Discord Gateway RX wrote a NUL one byte past the heap block, and dashboard WebChat silently dropped messages larger than one 256-byte LWS callback.

Bug 1 — Discord Gateway RX heap overflow (CRITICAL)

• File/function: src/channels/discord.c (discord_rx_append, now discord_helpers_rx_append)
• Trigger: libwebsockets rx_buffer_size = 65536. First 64KiB fragment doubles the buffer to 131072 with rx_len = 65536. Second 64KiB fragment: rx_cap < rx_len + len is false (131072 < 131072), grow is skipped, then rx_buf[rx_len] = '\0' writes at index 131072 (one past the allocation). Typical Discord READY (or any DISPATCH) payload >128KiB, well under RX_MAX (512KiB).
• Impact: Heap overflow in the Discord Gateway thread (crash / memory corruption). ASan catches a 1-byte write past the block.
• Distinct from fix(asap): wire provider and tools into POST /asap #53–fix(providers): fail closed when Anthropic parse realloc fails #80: fix(providers): fail closed when Anthropic parse realloc fails #80 is Anthropic parse_response_body realloc-before-success. fix(webchat): align WebSocket payload limit with agent response buffer #62 is WebChat outbound 8KiB vs 32KiB (ws_send_to / MSG_MAX), not Discord client RX. Telegram/OpenAI curl writers already include +1 for NUL.

Bug 2 — WebChat inbound frames not reassembled (HIGH)

• File/function: src/gateway/http.c protocols "ws" .rx_buffer_size = 256; src/gateway/http_lws.c ws_callback LWS_CALLBACK_RECEIVE
• Trigger: Dashboard WebChat text ≳ ~220 characters ({"type":"message","text":"..."}). LWS splits at 256 bytes; each chunk is cJSON_Parsed as a complete object and fails; the user message is dropped.
• Impact: Significant user-facing breakage: any non-trivial dashboard message never reaches the agent.
• Distinct from fix(webchat): align WebSocket payload limit with agent response buffer #62: that PR changes outbound dequeue/frame size, not inbound rx_buffer_size or fragment reassembly.

Fix

• Grow Discord RX when cap < rx_len + chunk + 1 (payload plus trailing NUL). Discard remaining fragments after overflow until lws_is_final_fragment.
• Set WebChat rx_buffer_size to WS_RX_BUFFER_SIZE (32KiB) so a full frame at MSG_MAX plus JSON envelope arrives in one RECEIVE.

Validation

• CI=true make test_discord_helpers (includes exact-fill 4095+1 and two 64KiB fragments)
• GCC ASan/UBSan on test_discord_helpers
• GATEWAY=1 compile of discord.c, http.c, http_lws.c

  

---

Note

Medium Risk
Touches live Discord Gateway and dashboard WebSocket receive paths; fixes memory safety and message delivery but changes buffer sizing on long-running gateway threads.

Overview
Fixes two inbound WebSocket buffer bugs: a one-byte heap overflow on Discord Gateway reassembly and silent loss of longer dashboard WebChat messages.

Discord Gateway RX now grows the reassembly buffer when payload + trailing NUL would exceed capacity (e.g. two 64 KiB LWS chunks no longer skip a grow at exactly 128 KiB). Logic lives in testable discord_helpers_rx_append; on overflow the client resets and skips fragments until the final LWS fragment via rx_skip.

WebChat inbound raises the "ws" protocol rx_buffer_size from 256 bytes to WS_RX_BUFFER_SIZE (WS_TEXT_MAX + envelope), with a compile-time assert, so typical {"type":"message","text":...} frames arrive in one RECEIVE instead of failing partial JSON parses.

Unit tests cover NUL-after-fill and dual 64 KiB fragment cases plus max-cap rejection.

^{Reviewed by Cursor Bugbot for commit 08716db. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Summary

This PR fixes two inbound WebSocket bugs that match the claimed intent. Discord Gateway RX now grows for the trailing NUL, so two 64 KiB libwebsockets fragments cannot write one byte past the heap block (typical READY). Dashboard WebChat raises ws rx_buffer_size from 256 to WS_TEXT_MAX + 64, which stops the deterministic drop of Chat JSON above ~220 characters. Helper tests for the exact-fill and dual-64 KiB cases pass locally under GCC ASan+UBSan. Required CI is red: make static fails cppcheck variableScope on the new helper.

Would be REQUEST_CHANGES if GitHub allowed it on this bot-authored PR. Do not merge until make static is green.

Must Fix

1. src/channels/discord_helpers.c:148 — cppcheck variableScope on ncap fails make static (--error-exitcode=1). GitHub Actions static, test, release on 08716db stopped at this check (run 34793224931). Declare ncap and p inside if (*cap < need) so the next pass does not fail on p. Same class as #80.

Should Fix

1. src/gateway/http.c / ws_callback RECEIVE still parses each callback as a complete JSON object. The buffer bump fixes the 256-byte LWS chunk split. It does not reassemble partial frames (lws_is_final_fragment). Discord already does. A split Chat frame can still be dropped.
2. rx_skip in src/channels/discord.c is untested. Helper tests never walk overflow-on-non-final plus the following frame.
3. WS_RX_BUFFER_SIZE = WS_TEXT_MAX + 64 does not cover JSON escape expansion (quotes, backslashes). Typical <input> Chat text is fine.

Nice to Have

• Helper test for payload max_cap - 1 (NUL fits) vs payload max_cap (reject).
• Keep WS_RX_BUFFER_SIZE next to WS_TEXT_MAX in ws.h instead of including ws.h from http_lws.h.
• test_gateway_http still has no /ws case; GATEWAY=1 CI does not lock inbound Chat.
• ncap *= 2 has no overflow guard. Production RX_MAX (512 KiB) is safe.

Positive Highlights

• Moving grow-for-NUL into discord_helpers_rx_append is the right split: discord.c is already over the 1000-line mark, and the 4095+1 plus two 64 KiB tests actually hit the old OOB.
• CHANGELOG Unreleased lines are present for both fixes (unlike several earlier bug-hunt PRs).
• rx_skip until the final LWS fragment is the correct fail-closed follow-through after overflow.
• Because tx_packet_size defaults to 0, the WebChat rx bump also sizes the send buffer, which is what lets a #62 32 KiB lws_write fit in one shot (ws_on_writable does not retry short writes).

Local check: helper tests passed when linked with -lm only (Makefile still passes -lcurl; this image has no curl import library). GCC ASan+UBSan detect_leaks=1 on test_discord_helpers passed. cppcheck is not installed here; the CI log is the oracle for variableScope.

  

_{Sent by Cursor Automation: Adrianno’s personal code review}

[cursor]

Could not approve: GitHub blocks self-approval on this cursor[bot] PR. Cursor Security Agent passed with no findings that need human review; Bugbot did not run on the current head, so that signal was skipped. adriannoes is already assigned; no additional reviewers were added.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}

[cursor]

Could not approve: GitHub blocks self-approval on this cursor[bot] PR. Cursor Security Agent passed with no findings that need human review; Bugbot did not run on the current head, so that signal was skipped. adriannoes is already assigned; no additional reviewers were added.

  

_{Sent by Cursor Approval Agent: Pull Request Router and Approver}