aiohttp: Multiple instances of excessive or unbounded memory/CPU use

Summary

While reassembling a WebSocket frame that arrived across many small transport reads, the reader kept one bytes object per read with no bound on the count. The per-object overhead is many times larger than the payload bytes, so a frame delivered a few bytes at a time could use far more memory than max_msg_size allows.

Impact

An attacker could cause excessive memory use in a WebSocket server, or a malicious server against a client, by sending a frame in a large number of tiny segments.