Merge pull request #4335 from ctiller/partial-send-header

Expand HPACK decoding test cases

2 files changed, 60 insertions, 2 deletions

diff --git a/src/core/transport/chttp2/hpack_parser.c b/src/core/transport/chttp2/hpack_parser.c
index 30f0d469e3..fea0000896 100644
--- a/src/core/transport/chttp2/hpack_parser.c
+++ b/src/core/transport/chttp2/hpack_parser.c
@@ -1066,7 +1066,7 @@ static int parse_value4(grpc_chttp2_hpack_parser *p, const gpr_uint8 *cur,
 error:
   gpr_log(GPR_ERROR,
           "integer overflow in hpack integer decoding: have 0x%08x, "
-          "got byte 0x%02x",
+          "got byte 0x%02x on byte 5",
           *p->parsing.value, *cur);
   return parse_error(p, cur, end);
 }
@@ -1091,7 +1091,8 @@ static int parse_value5up(grpc_chttp2_hpack_parser *p, const gpr_uint8 *cur,
 
   gpr_log(GPR_ERROR,
           "integer overflow in hpack integer decoding: have 0x%08x, "
-          "got byte 0x%02x sometime after byte 4");
+          "got byte 0x%02x sometime after byte 5",
+          *p->parsing.value, *cur);
   return parse_error(p, cur, end);
 }
 
diff --git a/test/core/bad_client/tests/headers.c b/test/core/bad_client/tests/headers.c
index 5547aca210..39ce7838de 100644
--- a/test/core/bad_client/tests/headers.c
+++ b/test/core/bad_client/tests/headers.c
@@ -96,6 +96,10 @@ int main(int argc, char **argv) {
                            0);
   GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
                            "\x00\x00\x05\x01\x24\x00\x00\x00\x01"
+                           "",
+                           GRPC_BAD_CLIENT_DISCONNECT);
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x05\x01\x24\x00\x00\x00\x01"
                            "\x00",
                            GRPC_BAD_CLIENT_DISCONNECT);
   GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
@@ -173,8 +177,50 @@ int main(int argc, char **argv) {
                            0);
   GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
                            "\x00\x00\x08\x01\x04\x00\x00\x00\x01"
+                           "\xff",
+                           GRPC_BAD_CLIENT_DISCONNECT);
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x08\x01\x04\x00\x00\x00\x01"
+                           "\xff\x80",
+                           GRPC_BAD_CLIENT_DISCONNECT);
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x08\x01\x04\x00\x00\x00\x01"
+                           "\xff\x80\x80",
+                           GRPC_BAD_CLIENT_DISCONNECT);
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x08\x01\x04\x00\x00\x00\x01"
+                           "\xff\x80\x80\x80",
+                           GRPC_BAD_CLIENT_DISCONNECT);
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x08\x01\x04\x00\x00\x00\x01"
+                           "\xff\x80\x80\x80\x80",
+                           GRPC_BAD_CLIENT_DISCONNECT);
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x08\x01\x04\x00\x00\x00\x01"
+                           "\xff\x80\x80\x80\x80\x80",
+                           GRPC_BAD_CLIENT_DISCONNECT);
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x08\x01\x04\x00\x00\x00\x01"
+                           "\xff\x80\x80\x80\x80\x80\x80",
+                           GRPC_BAD_CLIENT_DISCONNECT);
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x08\x01\x04\x00\x00\x00\x01"
                            "\xff\x80\x80\x80\x80\x80\x80\x00",
                            0);
+  /* overflow on byte 4 */
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x06\x01\x04\x00\x00\x00\x01"
+                           "\xff\x80\x80\x80\x80\x7f",
+                           GRPC_BAD_CLIENT_DISCONNECT);
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x06\x01\x04\x00\x00\x00\x01"
+                           "\xff\xff\xff\xff\xff\x0f",
+                           GRPC_BAD_CLIENT_DISCONNECT);
+  /* overflow after byte 4 */
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x08\x01\x04\x00\x00\x00\x01"
+                           "\xff\x80\x80\x80\x80\x80\x80\x02",
+                           0);
   /* end of headers mid-opcode */
   GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
                            "\x00\x00\x01\x01\x04\x00\x00\x00\x01"
@@ -187,11 +233,22 @@ int main(int argc, char **argv) {
                            "\x00\x00\x03\x01\x04\x00\x00\x00\x01"
                            "\x3f\xe1\x1f",
                            GRPC_BAD_CLIENT_DISCONNECT);
+  /* dynamic table size update: set too large */
   GRPC_RUN_BAD_CLIENT_TEST(verifier,
                            PFX_STR 
                            "\x00\x00\x03\x01\x04\x00\x00\x00\x01"
                            "\x3f\xf1\x1f",
                            0);
+  /* dynamic table size update: set twice */
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x04\x01\x04\x00\x00\x00\x01"
+                           "\x20\x3f\xe1\x1f",
+                           GRPC_BAD_CLIENT_DISCONNECT);
+  /* dynamic table size update: set thrice */
+  GRPC_RUN_BAD_CLIENT_TEST(verifier, PFX_STR
+                           "\x00\x00\x03\x01\x04\x00\x00\x00\x01"
+                           "\x20\x20\x20",
+                           0);
 
   /* non-ending header followed by continuation frame */
   GRPC_RUN_BAD_CLIENT_TEST(verifier,