Merge branch 'fuzzing-wonderful' into rollfwd

2 files changed, 7 insertions, 4 deletions

diff --git a/src/core/lib/surface/call.c b/src/core/lib/surface/call.c
index 63b0683df5..9852034fbb 100644
--- a/src/core/lib/surface/call.c
+++ b/src/core/lib/surface/call.c
@@ -989,12 +989,15 @@ static grpc_error *consolidate_batch_errors(batch_control *bctl) {
   if (n == 0) {
     return GRPC_ERROR_NONE;
   } else if (n == 1) {
-    return bctl->errors[0];
+    grpc_error *e = bctl->errors[0];
+    bctl->errors[0] = NULL;
+    return e;
   } else {
     grpc_error *error =
         GRPC_ERROR_CREATE_REFERENCING("Call batch failed", bctl->errors, n);
     for (size_t i = 0; i < n; i++) {
       GRPC_ERROR_UNREF(bctl->errors[i]);
+      bctl->errors[i] = NULL;
     }
     return error;
   }
@@ -1221,8 +1224,8 @@ static void validate_filtered_metadata(grpc_exec_ctx *exec_ctx,
 static void add_batch_error(grpc_exec_ctx *exec_ctx, batch_control *bctl,
                             grpc_error *error) {
   if (error == GRPC_ERROR_NONE) return;
-  cancel_with_error(exec_ctx, bctl->call, GRPC_ERROR_REF(error));
   int idx = (int)gpr_atm_no_barrier_fetch_add(&bctl->num_errors, 1);
+  if (idx > 0) cancel_with_error(exec_ctx, bctl->call, GRPC_ERROR_REF(error));
   bctl->errors[idx] = error;
 }
 
@@ -1258,7 +1261,7 @@ static void receiving_initial_metadata_ready(grpc_exec_ctx *exec_ctx,
         receiving_stream_ready, call->saved_receiving_stream_ready_bctlp,
         grpc_schedule_on_exec_ctx);
     call->saved_receiving_stream_ready_bctlp = NULL;
-    grpc_closure_sched(exec_ctx, saved_rsr_closure, error);
+    grpc_closure_sched(exec_ctx, saved_rsr_closure, GRPC_ERROR_REF(error));
   }
 
   gpr_mu_unlock(&call->mu);
diff --git a/src/core/lib/transport/static_metadata.c b/src/core/lib/transport/static_metadata.c
index 5adc3216c9..750711befd 100644
--- a/src/core/lib/transport/static_metadata.c
+++ b/src/core/lib/transport/static_metadata.c
@@ -474,7 +474,7 @@ grpc_mdelem grpc_static_mdelem_for_static_strings(int a, int b) {
   if (a == -1 || b == -1) return GRPC_MDNULL;
   uint32_t k = (uint32_t)(a * 98 + b);
   uint32_t h = elems_phash(k);
-  return elem_keys[h] == k
+  return h < GPR_ARRAY_SIZE(elem_keys) && elem_keys[h] == k
              ? GRPC_MAKE_MDELEM(&grpc_static_mdelem_table[elem_idxs[h]],
                                 GRPC_MDELEM_STORAGE_STATIC)
              : GRPC_MDNULL;