tree 8d900cd29587c021028ce62d25721539f0c4cbc1
parent dc41bf1a71fa71ffd0b7882604a8b3e7b8df70ea
author QUICHE team <quiche-dev@google.com> 1553120607 -0700
committer Copybara-Service <copybara-worker@google.com> 1553123439 -0700

Check new connection ID length before reading it

This CL fixes a buffer overflow in the NEW_CONNECTION_ID read path, and adds sanity checks to prevent similar issues from reoccuring. The issue was found by clusterfuzz:
https://bugs.chromium.org/p/chromium/issues/detail?id=943951#c4

gfe-relnote: trivial security fix when parsing invalid frame, not flag protected
PiperOrigin-RevId: 239486794
Change-Id: I70b8e7b4adfd52afbbcb3308ba7dded0416c884e