From d8552ab5ea2c0d78628c56e380148130f9dabf24 Mon Sep 17 00:00:00 2001 From: Craig Tiller Date: Tue, 8 Dec 2015 07:50:36 -0800 Subject: Fix typo --- src/core/transport/chttp2/frame_data.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/core/transport/chttp2') diff --git a/src/core/transport/chttp2/frame_data.c b/src/core/transport/chttp2/frame_data.c index e07fbb2cc7..38fa990758 100644 --- a/src/core/transport/chttp2/frame_data.c +++ b/src/core/transport/chttp2/frame_data.c @@ -118,7 +118,7 @@ void grpc_chttp2_encode_data(gpr_uint32 id, gpr_slice_buffer *inbuf, hdr = gpr_slice_malloc(9); p = GPR_SLICE_START_PTR(hdr); - GPR_ASSERT(write_bytes < 16777316); + GPR_ASSERT(write_bytes < (1<<24)); *p++ = (gpr_uint8)(write_bytes >> 16); *p++ = (gpr_uint8)(write_bytes >> 8); *p++ = (gpr_uint8)(write_bytes); -- cgit v1.2.3 From c3218147de0cc8109804f8959d7bfa6eac44b6ef Mon Sep 17 00:00:00 2001 From: Craig Tiller Date: Tue, 8 Dec 2015 08:30:39 -0800 Subject: Fix fuzzing detected crash --- src/core/transport/chttp2/hpack_parser.c | 22 +++++++++++++--------- test/core/bad_client/tests/headers.c | 6 ++++++ 2 files changed, 19 insertions(+), 9 deletions(-) (limited to 'src/core/transport/chttp2') diff --git a/src/core/transport/chttp2/hpack_parser.c b/src/core/transport/chttp2/hpack_parser.c index e5453000ec..30f0d469e3 100644 --- a/src/core/transport/chttp2/hpack_parser.c +++ b/src/core/transport/chttp2/hpack_parser.c @@ -1418,15 +1418,19 @@ grpc_chttp2_parse_error grpc_chttp2_header_parser_parse( GPR_TIMER_END("grpc_chttp2_hpack_parser_parse", 0); return GRPC_CHTTP2_CONNECTION_ERROR; } - if (parser->is_boundary) { - stream_parsing - ->got_metadata_on_parse[stream_parsing->header_frames_received] = 1; - stream_parsing->header_frames_received++; - grpc_chttp2_list_add_parsing_seen_stream(transport_parsing, - stream_parsing); - } - if (parser->is_eof) { - stream_parsing->received_close = 1; + /* need to check for null stream: this can occur if we receive an invalid + stream id on a header */ + if (stream_parsing != NULL) { + if (parser->is_boundary) { + stream_parsing + ->got_metadata_on_parse[stream_parsing->header_frames_received] = 1; + stream_parsing->header_frames_received++; + grpc_chttp2_list_add_parsing_seen_stream(transport_parsing, + stream_parsing); + } + if (parser->is_eof) { + stream_parsing->received_close = 1; + } } parser->on_header = on_header_not_set; parser->on_header_user_data = NULL; diff --git a/test/core/bad_client/tests/headers.c b/test/core/bad_client/tests/headers.c index 1d18a8241a..c16bfd623b 100644 --- a/test/core/bad_client/tests/headers.c +++ b/test/core/bad_client/tests/headers.c @@ -195,5 +195,11 @@ int main(int argc, char **argv) { "\x00\x00\x00\x09\x04\x00\x00\x00\x01", 0); + /* an invalid header found with fuzzing */ + GRPC_RUN_BAD_CLIENT_TEST(verifier, + PFX_STR + "\x00\x00\x00\x01\x39\x67\xed\x1d\x64", + GRPC_BAD_CLIENT_DISCONNECT); + return 0; } -- cgit v1.2.3