CVE-2020-27813: Integer overflow in github.com/gorilla/websocket

The vulnerability stems from two key areas: 1) In advanceFrame, payload length values from frames (especially 16/64-bit extended lengths) were directly assigned to readRemaining without overflow checks. This allowed attackers to set readRemaining to negative values via integer overflow, bypassing readLimit. 2) The messageReader.Read method modified readRemaining without overflow guards, enabling infinite loops when processing maliciously fragmented frames. The patch introduced setReadRemaining to validate() values and prevent overflow, confirming these were the vulnerable paths.