Fix failures in fuzzing tests

3 files changed, 18 insertions, 16 deletions

diff --git a/src/core/ext/transport/chttp2/transport/chttp2_transport.c b/src/core/ext/transport/chttp2/transport/chttp2_transport.c
index 8d29798a7f..de67794f5b 100644
--- a/src/core/ext/transport/chttp2/transport/chttp2_transport.c
+++ b/src/core/ext/transport/chttp2/transport/chttp2_transport.c
@@ -178,6 +178,7 @@ static void destruct_transport(grpc_exec_ctx *exec_ctx,
     t->write_cb_pool = next;
   }
 
+  gpr_free(t->ping_acks);
   gpr_free(t->peer_string);
   gpr_free(t);
 }
diff --git a/src/core/ext/transport/chttp2/transport/frame_ping.c b/src/core/ext/transport/chttp2/transport/frame_ping.c
index 20bc3107ce..7cf36cb94a 100644
--- a/src/core/ext/transport/chttp2/transport/frame_ping.c
+++ b/src/core/ext/transport/chttp2/transport/frame_ping.c
@@ -103,7 +103,7 @@ grpc_error *grpc_chttp2_ping_parser_parse(grpc_exec_ctx *exec_ctx, void *parser,
     } else {
       if (t->ping_ack_count == t->ping_ack_capacity) {
         t->ping_ack_capacity = GPR_MAX(t->ping_ack_capacity * 3 / 2, 3);
-        t->ping_acks = gpr_realloc(t->ping_acks, t->ping_ack_capacity);
+        t->ping_acks = gpr_realloc(t->ping_acks, t->ping_ack_capacity * sizeof(*t->ping_acks));
       }
       t->ping_acks[t->ping_ack_count++] = p->opaque_8bytes;
       grpc_chttp2_initiate_write(exec_ctx, t, false, "ping response");
diff --git a/src/core/ext/transport/chttp2/transport/parsing.c b/src/core/ext/transport/chttp2/transport/parsing.c
index 7e8ca55e83..ca9b931564 100644
--- a/src/core/ext/transport/chttp2/transport/parsing.c
+++ b/src/core/ext/transport/chttp2/transport/parsing.c
@@ -385,22 +385,23 @@ static grpc_error *update_incoming_window(grpc_exec_ctx *exec_ctx,
     grpc_chttp2_initiate_write(exec_ctx, t, false, "flow_control");
   }
 
-  if (incoming_frame_size >
-      s->incoming_window_delta +
-          t->settings[GRPC_ACKED_SETTINGS]
-                     [GRPC_CHTTP2_SETTINGS_INITIAL_WINDOW_SIZE]) {
-    char *msg;
-    gpr_asprintf(&msg, "frame of size %d overflows incoming window of %" PRId64,
-                 t->incoming_frame_size,
-                 s->incoming_window_delta +
-                     t->settings[GRPC_ACKED_SETTINGS]
-                                [GRPC_CHTTP2_SETTINGS_INITIAL_WINDOW_SIZE]);
-    grpc_error *err = GRPC_ERROR_CREATE(msg);
-    gpr_free(msg);
-    return err;
-  }
-
   if (s != NULL) {
+    if (incoming_frame_size >
+        s->incoming_window_delta +
+            t->settings[GRPC_ACKED_SETTINGS]
+                       [GRPC_CHTTP2_SETTINGS_INITIAL_WINDOW_SIZE]) {
+      char *msg;
+      gpr_asprintf(&msg,
+                   "frame of size %d overflows incoming window of %" PRId64,
+                   t->incoming_frame_size,
+                   s->incoming_window_delta +
+                       t->settings[GRPC_ACKED_SETTINGS]
+                                  [GRPC_CHTTP2_SETTINGS_INITIAL_WINDOW_SIZE]);
+      grpc_error *err = GRPC_ERROR_CREATE(msg);
+      gpr_free(msg);
+      return err;
+    }
+
     GRPC_CHTTP2_FLOW_DEBIT_STREAM("parse", t, s, incoming_window_delta,
                                   incoming_frame_size);
     if (s->incoming_window_delta - s->announce_window <=