Fix calculation of length in websocket.cc.

net/websockets/websocket.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 #include <limits>
 
 #include "net/websockets/websocket.h"
 
 #include "base/message_loop.h"
@@ skipping 362 matching lines @@
   while (p < end) {
     unsigned char frame_byte = static_cast<unsigned char>(*p++);
     if ((frame_byte & 0x80) == 0x80) {
       int length = 0;
       while (p < end && (*p & 0x80) == 0x80) {
         if (length > std::numeric_limits<int>::max() / 128) {
           // frame length overflow.
           socket_stream_->Close();
           return;
         }
-        length = length * 128 + *p & 0x7f;
+        length = length * 128 + (*p & 0x7f);
         ++p;
       }
       // Checks if the frame body hasn't been completely received yet.
       // It also checks the case the frame length bytes haven't been completely
       // received yet, because p == end and length > 0 in such case.
       if (p + length < end) {
         p += length;
         next_frame = p;
       }
     } else {
@@ skipping 38 matching lines @@
   WebSocketDelegate* delegate = delegate_;
   delegate_ = NULL;
   ready_state_ = CLOSED;
   if (!socket_stream_)
     return;
   socket_stream_ = NULL;
   delegate->OnClose(this);
 }
 
 }  // namespace net