[WebSocket] Fix handling of BFinal in WebSocket deflate. by ManickaP · Pull Request #132201 · dotnet/runtime

ManickaP · 2026-08-12T08:38:58Z

+fuzzing

azure-pipelines · 2026-08-12T08:39:50Z

Azure Pipelines: Successfully started running 6 pipeline(s). 10 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-08-12T08:41:35Z

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR addresses a permessage-deflate edge case where a DEFLATE BFINAL=1 block can cause the managed WebSocket inflater to stop consuming input and potentially hang receive loops, and it expands the fuzzing infrastructure by adding a WebSocket-focused fuzzer and OneFuzz deployment wiring.

Changes:

Detect DEFLATE stream termination (BFINAL=1) with unconsumed trailing compressed bytes and reject the message to avoid infinite no-progress inflation.
Add regression tests covering BFINAL=1-terminated compressed frames.
Add a new WebSocketFuzzer, improve local fuzzing ergonomics, and deploy the new fuzzer to OneFuzz.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs	Adds regression tests for `BFINAL=1`-terminated compressed messages.
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/ManagedWebSocket.cs	Minor adjustment in receive-buffer copy path (assert removal).
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/Compression/WebSocketInflater.cs	Adds `BFINAL`/stream-end detection and throws to prevent non-terminating inflation.
src/libraries/System.Net.WebSockets/src/Resources/Strings.resx	Adds a new resource string for the new rejection condition.
src/libraries/Fuzzing/README.md	Updates local fuzzing example invocation.
src/libraries/Fuzzing/DotnetFuzzing/Program.cs	Prints PID for file-based runs; adds a default `-timeout` to generated local-run scripts.
src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs	Introduces a new WebSocket fuzzer harness.
eng/pipelines/libraries/fuzzing/deploy-to-onefuzz.yml	Adds OneFuzz deployment step for the new WebSocket fuzzer.

Suppressed comments (2)

src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs:706

Same as above: prefer asserting SR.net_WebSockets_DataAfterBFinal (and WebSocketErrorCode) rather than a substring match, to align with other WebSocket error-message tests.

 var exception = await Assert.ThrowsAsync<WebSocketException>(
async () => await websocket.ReceiveAsync(buffer, CancellationToken));
Assert.Contains("BFINAL", exception.Message);
}

src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs:112

The harness uses cts.CancelAfter to prevent hangs, but it only catches WebSocketException. If the timeout triggers, OperationCanceledException will escape and be treated as a crash. Similarly, disposing inside the loop can cause ObjectDisposedException to escape.

 }
catch (WebSocketException)
{
// Expected
}

ManickaP · 2026-08-12T11:53:18Z

/ba-g BA is borked

ManickaP · 2026-08-12T08:38:58Z

+fuzzing

azure-pipelines · 2026-08-12T08:39:50Z

Azure Pipelines: Successfully started running 6 pipeline(s). 10 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-08-12T08:41:35Z

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR addresses a permessage-deflate edge case where a DEFLATE BFINAL=1 block can cause the managed WebSocket inflater to stop consuming input and potentially hang receive loops, and it expands the fuzzing infrastructure by adding a WebSocket-focused fuzzer and OneFuzz deployment wiring.

Changes:

Detect DEFLATE stream termination (BFINAL=1) with unconsumed trailing compressed bytes and reject the message to avoid infinite no-progress inflation.
Add regression tests covering BFINAL=1-terminated compressed frames.
Add a new WebSocketFuzzer, improve local fuzzing ergonomics, and deploy the new fuzzer to OneFuzz.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs	Adds regression tests for `BFINAL=1`-terminated compressed messages.
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/ManagedWebSocket.cs	Minor adjustment in receive-buffer copy path (assert removal).
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/Compression/WebSocketInflater.cs	Adds `BFINAL`/stream-end detection and throws to prevent non-terminating inflation.
src/libraries/System.Net.WebSockets/src/Resources/Strings.resx	Adds a new resource string for the new rejection condition.
src/libraries/Fuzzing/README.md	Updates local fuzzing example invocation.
src/libraries/Fuzzing/DotnetFuzzing/Program.cs	Prints PID for file-based runs; adds a default `-timeout` to generated local-run scripts.
src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs	Introduces a new WebSocket fuzzer harness.
eng/pipelines/libraries/fuzzing/deploy-to-onefuzz.yml	Adds OneFuzz deployment step for the new WebSocket fuzzer.

Suppressed comments (2)

src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs:706

Same as above: prefer asserting SR.net_WebSockets_DataAfterBFinal (and WebSocketErrorCode) rather than a substring match, to align with other WebSocket error-message tests.

 var exception = await Assert.ThrowsAsync<WebSocketException>(
async () => await websocket.ReceiveAsync(buffer, CancellationToken));
Assert.Contains("BFINAL", exception.Message);
}

src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs:112

The harness uses cts.CancelAfter to prevent hangs, but it only catches WebSocketException. If the timeout triggers, OperationCanceledException will escape and be treated as a crash. Similarly, disposing inside the loop can cause ObjectDisposedException to escape.

 }
catch (WebSocketException)
{
// Expected
}

ManickaP · 2026-08-12T11:53:18Z

/ba-g BA is borked

ManickaP · 2026-08-12T08:38:58Z

+fuzzing

azure-pipelines · 2026-08-12T08:39:50Z

Azure Pipelines: Successfully started running 6 pipeline(s). 10 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-08-12T08:41:35Z

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR addresses a permessage-deflate edge case where a DEFLATE BFINAL=1 block can cause the managed WebSocket inflater to stop consuming input and potentially hang receive loops, and it expands the fuzzing infrastructure by adding a WebSocket-focused fuzzer and OneFuzz deployment wiring.

Changes:

Detect DEFLATE stream termination (BFINAL=1) with unconsumed trailing compressed bytes and reject the message to avoid infinite no-progress inflation.
Add regression tests covering BFINAL=1-terminated compressed frames.
Add a new WebSocketFuzzer, improve local fuzzing ergonomics, and deploy the new fuzzer to OneFuzz.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs	Adds regression tests for `BFINAL=1`-terminated compressed messages.
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/ManagedWebSocket.cs	Minor adjustment in receive-buffer copy path (assert removal).
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/Compression/WebSocketInflater.cs	Adds `BFINAL`/stream-end detection and throws to prevent non-terminating inflation.
src/libraries/System.Net.WebSockets/src/Resources/Strings.resx	Adds a new resource string for the new rejection condition.
src/libraries/Fuzzing/README.md	Updates local fuzzing example invocation.
src/libraries/Fuzzing/DotnetFuzzing/Program.cs	Prints PID for file-based runs; adds a default `-timeout` to generated local-run scripts.
src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs	Introduces a new WebSocket fuzzer harness.
eng/pipelines/libraries/fuzzing/deploy-to-onefuzz.yml	Adds OneFuzz deployment step for the new WebSocket fuzzer.

Suppressed comments (2)

src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs:706

Same as above: prefer asserting SR.net_WebSockets_DataAfterBFinal (and WebSocketErrorCode) rather than a substring match, to align with other WebSocket error-message tests.

 var exception = await Assert.ThrowsAsync<WebSocketException>(
async () => await websocket.ReceiveAsync(buffer, CancellationToken));
Assert.Contains("BFINAL", exception.Message);
}

src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs:112

The harness uses cts.CancelAfter to prevent hangs, but it only catches WebSocketException. If the timeout triggers, OperationCanceledException will escape and be treated as a crash. Similarly, disposing inside the loop can cause ObjectDisposedException to escape.

 }
catch (WebSocketException)
{
// Expected
}

ManickaP · 2026-08-12T11:53:18Z

/ba-g BA is borked

ManickaP · 2026-08-12T08:38:58Z

+fuzzing

azure-pipelines · 2026-08-12T08:39:50Z

Azure Pipelines: Successfully started running 6 pipeline(s). 10 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-08-12T08:41:35Z

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR addresses a permessage-deflate edge case where a DEFLATE BFINAL=1 block can cause the managed WebSocket inflater to stop consuming input and potentially hang receive loops, and it expands the fuzzing infrastructure by adding a WebSocket-focused fuzzer and OneFuzz deployment wiring.

Changes:

Detect DEFLATE stream termination (BFINAL=1) with unconsumed trailing compressed bytes and reject the message to avoid infinite no-progress inflation.
Add regression tests covering BFINAL=1-terminated compressed frames.
Add a new WebSocketFuzzer, improve local fuzzing ergonomics, and deploy the new fuzzer to OneFuzz.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs	Adds regression tests for `BFINAL=1`-terminated compressed messages.
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/ManagedWebSocket.cs	Minor adjustment in receive-buffer copy path (assert removal).
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/Compression/WebSocketInflater.cs	Adds `BFINAL`/stream-end detection and throws to prevent non-terminating inflation.
src/libraries/System.Net.WebSockets/src/Resources/Strings.resx	Adds a new resource string for the new rejection condition.
src/libraries/Fuzzing/README.md	Updates local fuzzing example invocation.
src/libraries/Fuzzing/DotnetFuzzing/Program.cs	Prints PID for file-based runs; adds a default `-timeout` to generated local-run scripts.
src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs	Introduces a new WebSocket fuzzer harness.
eng/pipelines/libraries/fuzzing/deploy-to-onefuzz.yml	Adds OneFuzz deployment step for the new WebSocket fuzzer.

Suppressed comments (2)

src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs:706

Same as above: prefer asserting SR.net_WebSockets_DataAfterBFinal (and WebSocketErrorCode) rather than a substring match, to align with other WebSocket error-message tests.

 var exception = await Assert.ThrowsAsync<WebSocketException>(
async () => await websocket.ReceiveAsync(buffer, CancellationToken));
Assert.Contains("BFINAL", exception.Message);
}

src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs:112

The harness uses cts.CancelAfter to prevent hangs, but it only catches WebSocketException. If the timeout triggers, OperationCanceledException will escape and be treated as a crash. Similarly, disposing inside the loop can cause ObjectDisposedException to escape.

 }
catch (WebSocketException)
{
// Expected
}

ManickaP · 2026-08-12T11:53:18Z

/ba-g BA is borked

ManickaP · 2026-08-12T08:38:58Z

+fuzzing

azure-pipelines · 2026-08-12T08:39:50Z

Azure Pipelines: Successfully started running 6 pipeline(s). 10 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-08-12T08:41:35Z

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR addresses a permessage-deflate edge case where a DEFLATE BFINAL=1 block can cause the managed WebSocket inflater to stop consuming input and potentially hang receive loops, and it expands the fuzzing infrastructure by adding a WebSocket-focused fuzzer and OneFuzz deployment wiring.

Changes:

Detect DEFLATE stream termination (BFINAL=1) with unconsumed trailing compressed bytes and reject the message to avoid infinite no-progress inflation.
Add regression tests covering BFINAL=1-terminated compressed frames.
Add a new WebSocketFuzzer, improve local fuzzing ergonomics, and deploy the new fuzzer to OneFuzz.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs	Adds regression tests for `BFINAL=1`-terminated compressed messages.
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/ManagedWebSocket.cs	Minor adjustment in receive-buffer copy path (assert removal).
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/Compression/WebSocketInflater.cs	Adds `BFINAL`/stream-end detection and throws to prevent non-terminating inflation.
src/libraries/System.Net.WebSockets/src/Resources/Strings.resx	Adds a new resource string for the new rejection condition.
src/libraries/Fuzzing/README.md	Updates local fuzzing example invocation.
src/libraries/Fuzzing/DotnetFuzzing/Program.cs	Prints PID for file-based runs; adds a default `-timeout` to generated local-run scripts.
src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs	Introduces a new WebSocket fuzzer harness.
eng/pipelines/libraries/fuzzing/deploy-to-onefuzz.yml	Adds OneFuzz deployment step for the new WebSocket fuzzer.

Suppressed comments (2)

src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs:706

Same as above: prefer asserting SR.net_WebSockets_DataAfterBFinal (and WebSocketErrorCode) rather than a substring match, to align with other WebSocket error-message tests.

 var exception = await Assert.ThrowsAsync<WebSocketException>(
async () => await websocket.ReceiveAsync(buffer, CancellationToken));
Assert.Contains("BFINAL", exception.Message);
}

src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs:112

The harness uses cts.CancelAfter to prevent hangs, but it only catches WebSocketException. If the timeout triggers, OperationCanceledException will escape and be treated as a crash. Similarly, disposing inside the loop can cause ObjectDisposedException to escape.

 }
catch (WebSocketException)
{
// Expected
}

ManickaP · 2026-08-12T11:53:18Z

/ba-g BA is borked

ManickaP · 2026-08-12T08:38:58Z

+fuzzing

azure-pipelines · 2026-08-12T08:39:50Z

Azure Pipelines: Successfully started running 6 pipeline(s). 10 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-08-12T08:41:35Z

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR addresses a permessage-deflate edge case where a DEFLATE BFINAL=1 block can cause the managed WebSocket inflater to stop consuming input and potentially hang receive loops, and it expands the fuzzing infrastructure by adding a WebSocket-focused fuzzer and OneFuzz deployment wiring.

Changes:

Detect DEFLATE stream termination (BFINAL=1) with unconsumed trailing compressed bytes and reject the message to avoid infinite no-progress inflation.
Add regression tests covering BFINAL=1-terminated compressed frames.
Add a new WebSocketFuzzer, improve local fuzzing ergonomics, and deploy the new fuzzer to OneFuzz.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs	Adds regression tests for `BFINAL=1`-terminated compressed messages.
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/ManagedWebSocket.cs	Minor adjustment in receive-buffer copy path (assert removal).
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/Compression/WebSocketInflater.cs	Adds `BFINAL`/stream-end detection and throws to prevent non-terminating inflation.
src/libraries/System.Net.WebSockets/src/Resources/Strings.resx	Adds a new resource string for the new rejection condition.
src/libraries/Fuzzing/README.md	Updates local fuzzing example invocation.
src/libraries/Fuzzing/DotnetFuzzing/Program.cs	Prints PID for file-based runs; adds a default `-timeout` to generated local-run scripts.
src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs	Introduces a new WebSocket fuzzer harness.
eng/pipelines/libraries/fuzzing/deploy-to-onefuzz.yml	Adds OneFuzz deployment step for the new WebSocket fuzzer.

Suppressed comments (2)

src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs:706

Same as above: prefer asserting SR.net_WebSockets_DataAfterBFinal (and WebSocketErrorCode) rather than a substring match, to align with other WebSocket error-message tests.

 var exception = await Assert.ThrowsAsync<WebSocketException>(
async () => await websocket.ReceiveAsync(buffer, CancellationToken));
Assert.Contains("BFINAL", exception.Message);
}

src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs:112

The harness uses cts.CancelAfter to prevent hangs, but it only catches WebSocketException. If the timeout triggers, OperationCanceledException will escape and be treated as a crash. Similarly, disposing inside the loop can cause ObjectDisposedException to escape.

 }
catch (WebSocketException)
{
// Expected
}

ManickaP · 2026-08-12T11:53:18Z

/ba-g BA is borked

ManickaP · 2026-08-12T08:38:58Z

+fuzzing

azure-pipelines · 2026-08-12T08:39:50Z

Azure Pipelines: Successfully started running 6 pipeline(s). 10 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-08-12T08:41:35Z

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR addresses a permessage-deflate edge case where a DEFLATE BFINAL=1 block can cause the managed WebSocket inflater to stop consuming input and potentially hang receive loops, and it expands the fuzzing infrastructure by adding a WebSocket-focused fuzzer and OneFuzz deployment wiring.

Changes:

Detect DEFLATE stream termination (BFINAL=1) with unconsumed trailing compressed bytes and reject the message to avoid infinite no-progress inflation.
Add regression tests covering BFINAL=1-terminated compressed frames.
Add a new WebSocketFuzzer, improve local fuzzing ergonomics, and deploy the new fuzzer to OneFuzz.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs	Adds regression tests for `BFINAL=1`-terminated compressed messages.
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/ManagedWebSocket.cs	Minor adjustment in receive-buffer copy path (assert removal).
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/Compression/WebSocketInflater.cs	Adds `BFINAL`/stream-end detection and throws to prevent non-terminating inflation.
src/libraries/System.Net.WebSockets/src/Resources/Strings.resx	Adds a new resource string for the new rejection condition.
src/libraries/Fuzzing/README.md	Updates local fuzzing example invocation.
src/libraries/Fuzzing/DotnetFuzzing/Program.cs	Prints PID for file-based runs; adds a default `-timeout` to generated local-run scripts.
src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs	Introduces a new WebSocket fuzzer harness.
eng/pipelines/libraries/fuzzing/deploy-to-onefuzz.yml	Adds OneFuzz deployment step for the new WebSocket fuzzer.

Suppressed comments (2)

src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs:706

Same as above: prefer asserting SR.net_WebSockets_DataAfterBFinal (and WebSocketErrorCode) rather than a substring match, to align with other WebSocket error-message tests.

 var exception = await Assert.ThrowsAsync<WebSocketException>(
async () => await websocket.ReceiveAsync(buffer, CancellationToken));
Assert.Contains("BFINAL", exception.Message);
}

src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs:112

The harness uses cts.CancelAfter to prevent hangs, but it only catches WebSocketException. If the timeout triggers, OperationCanceledException will escape and be treated as a crash. Similarly, disposing inside the loop can cause ObjectDisposedException to escape.

 }
catch (WebSocketException)
{
// Expected
}

ManickaP · 2026-08-12T11:53:18Z

/ba-g BA is borked

ManickaP · 2026-08-12T08:38:58Z

+fuzzing

azure-pipelines · 2026-08-12T08:39:50Z

Azure Pipelines: Successfully started running 6 pipeline(s). 10 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run.

dotnet-policy-service · 2026-08-12T08:41:35Z

Tagging subscribers to this area: @karelz, @dotnet/ncl
See info in area-owners.md if you want to be subscribed.

Copilot

Pull request overview

This PR addresses a permessage-deflate edge case where a DEFLATE BFINAL=1 block can cause the managed WebSocket inflater to stop consuming input and potentially hang receive loops, and it expands the fuzzing infrastructure by adding a WebSocket-focused fuzzer and OneFuzz deployment wiring.

Changes:

Detect DEFLATE stream termination (BFINAL=1) with unconsumed trailing compressed bytes and reject the message to avoid infinite no-progress inflation.
Add regression tests covering BFINAL=1-terminated compressed frames.
Add a new WebSocketFuzzer, improve local fuzzing ergonomics, and deploy the new fuzzer to OneFuzz.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs	Adds regression tests for `BFINAL=1`-terminated compressed messages.
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/ManagedWebSocket.cs	Minor adjustment in receive-buffer copy path (assert removal).
src/libraries/System.Net.WebSockets/src/System/Net/WebSockets/Compression/WebSocketInflater.cs	Adds `BFINAL`/stream-end detection and throws to prevent non-terminating inflation.
src/libraries/System.Net.WebSockets/src/Resources/Strings.resx	Adds a new resource string for the new rejection condition.
src/libraries/Fuzzing/README.md	Updates local fuzzing example invocation.
src/libraries/Fuzzing/DotnetFuzzing/Program.cs	Prints PID for file-based runs; adds a default `-timeout` to generated local-run scripts.
src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs	Introduces a new WebSocket fuzzer harness.
eng/pipelines/libraries/fuzzing/deploy-to-onefuzz.yml	Adds OneFuzz deployment step for the new WebSocket fuzzer.

Suppressed comments (2)

src/libraries/System.Net.WebSockets/tests/WebSocketDeflateTests.cs:706

Same as above: prefer asserting SR.net_WebSockets_DataAfterBFinal (and WebSocketErrorCode) rather than a substring match, to align with other WebSocket error-message tests.

 var exception = await Assert.ThrowsAsync<WebSocketException>(
async () => await websocket.ReceiveAsync(buffer, CancellationToken));
Assert.Contains("BFINAL", exception.Message);
}

src/libraries/Fuzzing/DotnetFuzzing/Fuzzers/WebSocketFuzzer.cs:112

The harness uses cts.CancelAfter to prevent hangs, but it only catches WebSocketException. If the timeout triggers, OperationCanceledException will escape and be treated as a crash. Similarly, disposing inside the loop can cause ObjectDisposedException to escape.

 }
catch (WebSocketException)
{
// Expected
}

ManickaP · 2026-08-12T11:53:18Z

/ba-g BA is borked

Fix handling of BFinal in WebSocket deflate.
cef45b0

ManickaP requested review from a team and MihaZupan and a lite review from Copilot August 12, 2026 08:38

github-actionsBot added the area-System.Net label Aug 12, 2026

Copilotstarted reviewing on behalf of ManickaP August 12, 2026 08:39 View session

dotnet-policy-serviceBot assigned ManickaP Aug 12, 2026

CopilotAI reviewed Aug 12, 2026
View reviewed changes

This was referenced Aug 12, 2026
slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883
Open
The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008
Open

MihaZupan approved these changes Aug 12, 2026
View reviewed changes

ManickaP merged commit 02e8771 into dotnet:mainAug 12, 2026
117 of 120 checks passed

ManickaP deleted the websocket-fix branch August 12, 2026 11:53

karelz added this to the 11.0.0 milestone Aug 12, 2026

dotnet-maestroBot mentioned this pull request Aug 13, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#8272
Merged

dotnet-milestone-botBot modified the milestones: 11.0.0, 11.0-rc1 Aug 13, 2026

Fix handling of BFinal in WebSocket deflate.
cef45b0

ManickaP requested review from a team and MihaZupan and a lite review from Copilot August 12, 2026 08:38

github-actionsBot added the area-System.Net label Aug 12, 2026

Copilotstarted reviewing on behalf of ManickaP August 12, 2026 08:39 View session

dotnet-policy-serviceBot assigned ManickaP Aug 12, 2026

CopilotAI reviewed Aug 12, 2026
View reviewed changes

This was referenced Aug 12, 2026
slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883
Open
The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008
Open

MihaZupan approved these changes Aug 12, 2026
View reviewed changes

ManickaP merged commit 02e8771 into dotnet:mainAug 12, 2026
117 of 120 checks passed

ManickaP deleted the websocket-fix branch August 12, 2026 11:53

karelz added this to the 11.0.0 milestone Aug 12, 2026

dotnet-maestroBot mentioned this pull request Aug 13, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#8272
Merged

dotnet-milestone-botBot modified the milestones: 11.0.0, 11.0-rc1 Aug 13, 2026

Fix handling of BFinal in WebSocket deflate.
cef45b0

ManickaP requested review from a team and MihaZupan and a lite review from Copilot August 12, 2026 08:38

github-actionsBot added the area-System.Net label Aug 12, 2026

Copilotstarted reviewing on behalf of ManickaP August 12, 2026 08:39 View session

dotnet-policy-serviceBot assigned ManickaP Aug 12, 2026

CopilotAI reviewed Aug 12, 2026
View reviewed changes

This was referenced Aug 12, 2026
slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883
Open
The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008
Open

MihaZupan approved these changes Aug 12, 2026
View reviewed changes

ManickaP merged commit 02e8771 into dotnet:mainAug 12, 2026
117 of 120 checks passed

ManickaP deleted the websocket-fix branch August 12, 2026 11:53

karelz added this to the 11.0.0 milestone Aug 12, 2026

dotnet-maestroBot mentioned this pull request Aug 13, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#8272
Merged

dotnet-milestone-botBot modified the milestones: 11.0.0, 11.0-rc1 Aug 13, 2026

Fix handling of BFinal in WebSocket deflate.
cef45b0

ManickaP requested review from a team and MihaZupan and a lite review from Copilot August 12, 2026 08:38

github-actionsBot added the area-System.Net label Aug 12, 2026

Copilotstarted reviewing on behalf of ManickaP August 12, 2026 08:39 View session

dotnet-policy-serviceBot assigned ManickaP Aug 12, 2026

CopilotAI reviewed Aug 12, 2026
View reviewed changes

This was referenced Aug 12, 2026
slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883
Open
The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008
Open

MihaZupan approved these changes Aug 12, 2026
View reviewed changes

ManickaP merged commit 02e8771 into dotnet:mainAug 12, 2026
117 of 120 checks passed

ManickaP deleted the websocket-fix branch August 12, 2026 11:53

karelz added this to the 11.0.0 milestone Aug 12, 2026

dotnet-maestroBot mentioned this pull request Aug 13, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#8272
Merged

dotnet-milestone-botBot modified the milestones: 11.0.0, 11.0-rc1 Aug 13, 2026

Fix handling of BFinal in WebSocket deflate.
cef45b0

ManickaP requested review from a team and MihaZupan and a lite review from Copilot August 12, 2026 08:38

github-actionsBot added the area-System.Net label Aug 12, 2026

Copilotstarted reviewing on behalf of ManickaP August 12, 2026 08:39 View session

dotnet-policy-serviceBot assigned ManickaP Aug 12, 2026

CopilotAI reviewed Aug 12, 2026
View reviewed changes

This was referenced Aug 12, 2026
slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883
Open
The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008
Open

MihaZupan approved these changes Aug 12, 2026
View reviewed changes

ManickaP merged commit 02e8771 into dotnet:mainAug 12, 2026
117 of 120 checks passed

ManickaP deleted the websocket-fix branch August 12, 2026 11:53

karelz added this to the 11.0.0 milestone Aug 12, 2026

dotnet-maestroBot mentioned this pull request Aug 13, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#8272
Merged

dotnet-milestone-botBot modified the milestones: 11.0.0, 11.0-rc1 Aug 13, 2026

Fix handling of BFinal in WebSocket deflate.
cef45b0

ManickaP requested review from a team and MihaZupan and a lite review from Copilot August 12, 2026 08:38

github-actionsBot added the area-System.Net label Aug 12, 2026

Copilotstarted reviewing on behalf of ManickaP August 12, 2026 08:39 View session

dotnet-policy-serviceBot assigned ManickaP Aug 12, 2026

CopilotAI reviewed Aug 12, 2026
View reviewed changes

This was referenced Aug 12, 2026
slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883
Open
The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008
Open

MihaZupan approved these changes Aug 12, 2026
View reviewed changes

ManickaP merged commit 02e8771 into dotnet:mainAug 12, 2026
117 of 120 checks passed

ManickaP deleted the websocket-fix branch August 12, 2026 11:53

karelz added this to the 11.0.0 milestone Aug 12, 2026

dotnet-maestroBot mentioned this pull request Aug 13, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#8272
Merged

dotnet-milestone-botBot modified the milestones: 11.0.0, 11.0-rc1 Aug 13, 2026

Fix handling of BFinal in WebSocket deflate.
cef45b0

ManickaP requested review from a team and MihaZupan and a lite review from Copilot August 12, 2026 08:38

github-actionsBot added the area-System.Net label Aug 12, 2026

Copilotstarted reviewing on behalf of ManickaP August 12, 2026 08:39 View session

dotnet-policy-serviceBot assigned ManickaP Aug 12, 2026

CopilotAI reviewed Aug 12, 2026
View reviewed changes

This was referenced Aug 12, 2026
slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883
Open
The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008
Open

MihaZupan approved these changes Aug 12, 2026
View reviewed changes

ManickaP merged commit 02e8771 into dotnet:mainAug 12, 2026
117 of 120 checks passed

ManickaP deleted the websocket-fix branch August 12, 2026 11:53

karelz added this to the 11.0.0 milestone Aug 12, 2026

dotnet-maestroBot mentioned this pull request Aug 13, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#8272
Merged

dotnet-milestone-botBot modified the milestones: 11.0.0, 11.0-rc1 Aug 13, 2026

Fix handling of BFinal in WebSocket deflate.
cef45b0

ManickaP requested review from a team and MihaZupan and a lite review from Copilot August 12, 2026 08:38

github-actionsBot added the area-System.Net label Aug 12, 2026

Copilotstarted reviewing on behalf of ManickaP August 12, 2026 08:39 View session

dotnet-policy-serviceBot assigned ManickaP Aug 12, 2026

CopilotAI reviewed Aug 12, 2026
View reviewed changes

This was referenced Aug 12, 2026
slow macOS - "##[error]The job running on agent Azure Pipelines 9 ran longer than the maximum time of 60 minutes." dotnet/dnceng#1883
Open
The Operation will be canceled. The next steps may not contain expected logs. dotnet/dnceng#3008
Open

MihaZupan approved these changes Aug 12, 2026
View reviewed changes

ManickaP merged commit 02e8771 into dotnet:mainAug 12, 2026
117 of 120 checks passed

ManickaP deleted the websocket-fix branch August 12, 2026 11:53

karelz added this to the 11.0.0 milestone Aug 12, 2026

dotnet-maestroBot mentioned this pull request Aug 13, 2026
[main] Source code updates from dotnet/runtime dotnet/dotnet#8272
Merged

dotnet-milestone-botBot modified the milestones: 11.0.0, 11.0-rc1 Aug 13, 2026

Uh oh!

Conversation

ManickaP commented Aug 12, 2026

Uh oh!

azure-pipelinesBot commented Aug 12, 2026

Uh oh!

dotnet-policy-serviceBot commented Aug 12, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ManickaP commented Aug 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

ManickaP commented Aug 12, 2026

Uh oh!

azure-pipelinesBot commented Aug 12, 2026

Uh oh!

dotnet-policy-serviceBot commented Aug 12, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ManickaP commented Aug 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

ManickaP commented Aug 12, 2026

Uh oh!

azure-pipelinesBot commented Aug 12, 2026

Uh oh!

dotnet-policy-serviceBot commented Aug 12, 2026

Uh oh!

CopilotAI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ManickaP commented Aug 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects