diff options
| -rw-r--r-- | src/core/ext/transport/chttp2/transport/frame_data.c | 10 | ||||
| -rw-r--r-- | src/core/ext/transport/chttp2/transport/frame_data.h | 3 | ||||
| -rw-r--r-- | test/core/end2end/fuzzers/server_fuzzer_corpus/9a6963b0d0fcb0e91a31748c47c6f0e1e842fea9 | bin | 0 -> 605 bytes | |||
| -rw-r--r-- | test/core/end2end/fuzzers/server_fuzzer_corpus/a32be0653ccc65463445b4aaf24a7a1164d5c642 | bin | 0 -> 101 bytes | |||
| -rw-r--r-- | test/core/end2end/fuzzers/server_fuzzer_corpus/crash-41ab0e868e84612275f77118f9e832bc94ff45c5 | bin | 0 -> 605 bytes | |||
| -rw-r--r-- | test/core/end2end/fuzzers/server_fuzzer_corpus/fb84edfa9e8cbddba26a7184e7fdc219bde556c0 | bin | 0 -> 67 bytes |
6 files changed, 8 insertions, 5 deletions
diff --git a/src/core/ext/transport/chttp2/transport/frame_data.c b/src/core/ext/transport/chttp2/transport/frame_data.c index 9c301d1608..1995ad66e3 100644 --- a/src/core/ext/transport/chttp2/transport/frame_data.c +++ b/src/core/ext/transport/chttp2/transport/frame_data.c @@ -159,6 +159,9 @@ grpc_chttp2_parse_error grpc_chttp2_data_parser_parse( } switch (p->state) { + case GRPC_CHTTP2_DATA_ERROR: + p->state = GRPC_CHTTP2_DATA_ERROR; + return GRPC_CHTTP2_STREAM_ERROR; fh_0: case GRPC_CHTTP2_DATA_FH_0: stream_parsing->stats.incoming.framing_bytes++; @@ -172,6 +175,7 @@ grpc_chttp2_parse_error grpc_chttp2_data_parser_parse( break; default: gpr_log(GPR_ERROR, "Bad GRPC frame type 0x%02x", p->frame_type); + p->state = GRPC_CHTTP2_DATA_ERROR; return GRPC_CHTTP2_STREAM_ERROR; } if (++cur == end) { @@ -218,13 +222,11 @@ grpc_chttp2_parse_error grpc_chttp2_data_parser_parse( message_flags, &p->incoming_frames); /* fallthrough */ case GRPC_CHTTP2_DATA_FRAME: + grpc_chttp2_list_add_parsing_seen_stream(transport_parsing, + stream_parsing); if (cur == end) { - grpc_chttp2_list_add_parsing_seen_stream(transport_parsing, - stream_parsing); return GRPC_CHTTP2_PARSE_OK; } - grpc_chttp2_list_add_parsing_seen_stream(transport_parsing, - stream_parsing); uint32_t remaining = (uint32_t)(end - cur); if (remaining == p->frame_size) { stream_parsing->stats.incoming.data_bytes += p->frame_size; diff --git a/src/core/ext/transport/chttp2/transport/frame_data.h b/src/core/ext/transport/chttp2/transport/frame_data.h index 2ff32963d6..af71f483a2 100644 --- a/src/core/ext/transport/chttp2/transport/frame_data.h +++ b/src/core/ext/transport/chttp2/transport/frame_data.h @@ -49,7 +49,8 @@ typedef enum { GRPC_CHTTP2_DATA_FH_2, GRPC_CHTTP2_DATA_FH_3, GRPC_CHTTP2_DATA_FH_4, - GRPC_CHTTP2_DATA_FRAME + GRPC_CHTTP2_DATA_FRAME, + GRPC_CHTTP2_DATA_ERROR } grpc_chttp2_stream_state; typedef struct grpc_chttp2_incoming_byte_stream diff --git a/test/core/end2end/fuzzers/server_fuzzer_corpus/9a6963b0d0fcb0e91a31748c47c6f0e1e842fea9 b/test/core/end2end/fuzzers/server_fuzzer_corpus/9a6963b0d0fcb0e91a31748c47c6f0e1e842fea9 Binary files differnew file mode 100644 index 0000000000..e8fef7f1cf --- /dev/null +++ b/test/core/end2end/fuzzers/server_fuzzer_corpus/9a6963b0d0fcb0e91a31748c47c6f0e1e842fea9 diff --git a/test/core/end2end/fuzzers/server_fuzzer_corpus/a32be0653ccc65463445b4aaf24a7a1164d5c642 b/test/core/end2end/fuzzers/server_fuzzer_corpus/a32be0653ccc65463445b4aaf24a7a1164d5c642 Binary files differnew file mode 100644 index 0000000000..a4c4bf3a44 --- /dev/null +++ b/test/core/end2end/fuzzers/server_fuzzer_corpus/a32be0653ccc65463445b4aaf24a7a1164d5c642 diff --git a/test/core/end2end/fuzzers/server_fuzzer_corpus/crash-41ab0e868e84612275f77118f9e832bc94ff45c5 b/test/core/end2end/fuzzers/server_fuzzer_corpus/crash-41ab0e868e84612275f77118f9e832bc94ff45c5 Binary files differnew file mode 100644 index 0000000000..87bfefb849 --- /dev/null +++ b/test/core/end2end/fuzzers/server_fuzzer_corpus/crash-41ab0e868e84612275f77118f9e832bc94ff45c5 diff --git a/test/core/end2end/fuzzers/server_fuzzer_corpus/fb84edfa9e8cbddba26a7184e7fdc219bde556c0 b/test/core/end2end/fuzzers/server_fuzzer_corpus/fb84edfa9e8cbddba26a7184e7fdc219bde556c0 Binary files differnew file mode 100644 index 0000000000..f5de9d4fc8 --- /dev/null +++ b/test/core/end2end/fuzzers/server_fuzzer_corpus/fb84edfa9e8cbddba26a7184e7fdc219bde556c0 |