func: int CVE_2014_9374_PATCHED_AST_OPTIONAL_API_NAME(ast_websocket_read)(struct ast_websocket *session, char **payload, uint64_t *payload_len, enum ast_websocket_opcode *opcode, int *fragmented) char buf [ MAXIMUM_FRAME_SIZE ] = "" ; size_t options_len = 0 , frame_size = 0 ; * payload = NULL; * payload_len = 0; if ( ws_safe_read ( session , & buf [ 0 ] , MIN_WS_HDR_SZ , opcode ) )  frame_size += MIN_WS_HDR_SZ; * opcode = buf [ 0 ] & 0xf; * payload_len = buf [ 1 ] & 0x7f; if ( * opcode == AST_WEBSOCKET_OPCODE_TEXT || * opcode == AST_WEBSOCKET_OPCODE_BINARY || * opcode == AST_WEBSOCKET_OPCODE_CONTINUATION || * opcode == AST_WEBSOCKET_OPCODE_PING || * opcode == AST_WEBSOCKET_OPCODE_PONG )  mask_present = ( buf [ 1 ] >> 7 ) & 1; options_len += mask_present ? 4 : 0; options_len += ( * payload_len == 126 ) ? 2 : ( * payload_len == 127 ) ? 8 : 0; if ( options_len )  if ( ws_safe_read ( session , & buf [ frame_size ] , options_len , opcode ) )  frame_size += options_len; if ( * payload_len == 126 )  * payload_len = ntohs ( get_unaligned_uint16 ( & buf [ 2 ] ) ); mask = & buf [ 4 ]; if ( * payload_len == 127 )  * payload_len = ntohl ( get_unaligned_uint64 ( & buf [ 2 ] ) ); mask = & buf [ 10 ]; mask = & buf [ 2 ]; * payload = & buf [ frame_size ]; frame_size = frame_size + ( * payload_len ); if ( frame_size > MAXIMUM_FRAME_SIZE )  if ( ws_safe_read ( session , ( * payload ) , ( * payload_len ) , opcode ) )  if ( mask_present )  unsigned int pos ; for (pos = 0; pos < *payload_len; pos++) ( * payload ) [ pos ] ^= mask [ pos % 4 ]; if ( ( * opcode == AST_WEBSOCKET_OPCODE_PING ) && ( ast_websocket_write ( session , AST_WEBSOCKET_OPCODE_PONG , * payload , * payload_len ) ) )  * payload_len = 0; if ( * payload_len )  if ( ! ( new_payload = ast_realloc ( session -> payload , ( session -> payload_len + * payload_len ) ) ) )  * payload_len = 0; session -> payload = new_payload; memcpy ( ( session -> payload + session -> payload_len ) , ( * payload ) , ( * payload_len ) ); session -> payload_len += * payload_len; if ( ! fin && session -> reconstruct && ( session -> payload_len < session -> reconstruct ) )  * opcode = session -> opcode; * payload_len = session -> payload_len; * payload = session -> payload; 