Fix QpackRoundTripFuzzer when cookies are split along '\0'.
The root of the issue is that ValueSplittingHeaderList splits the value of the
cookie header along '\0', but SpdyHeaderBlock::AppendValueOrAddHeader() joins
them with "; " separators. The long term solution will be changing
ValueSplittingHeaderList to split cookies along semicolons, but this logic in
QpackRoundTripFuzzer will still be necessary, becaue "value1;value2" will be
transformed by an encoding-decoding round-trip to "value1; value2", which
QpackRoundTripFuzzer should not crash on.
Also include regular and minimized test cases from b/131395084, b/131409242, and
https://crbug.com/957840.
gfe-relnote: n/a. Change in fuzzer only.
PiperOrigin-RevId: 247281474
Change-Id: I405066d45ae5e6cbf4c53d8a4f3afb1d0f6b3327
diff --git a/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer.cc b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer.cc
index 15608da..5b7f8d3 100644
--- a/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer.cc
+++ b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer.cc
@@ -8,6 +8,7 @@
#include "net/third_party/quiche/src/quic/core/qpack/qpack_decoder_test_utils.h"
#include "net/third_party/quiche/src/quic/core/qpack/qpack_encoder_test_utils.h"
+#include "net/third_party/quiche/src/quic/core/qpack/value_splitting_header_list.h"
#include "net/third_party/quiche/src/quic/platform/api/quic_fuzzed_data_provider.h"
#include "net/third_party/quiche/src/spdy/core/spdy_header_block.h"
@@ -142,8 +143,15 @@
CHECK(handler.decoding_completed());
CHECK(!handler.decoding_error_detected());
+ // Encoder splits |header_list| header keys along '\0' characters. Do the
+ // same so that we get matching results.
+ ValueSplittingHeaderList splitting_header_list(&header_list);
+ spdy::SpdyHeaderBlock expected_header_list;
+ for (const auto& header : splitting_header_list) {
+ expected_header_list.AppendValueOrAddHeader(header.first, header.second);
+ }
// Compare resulting header list to original.
- CHECK(header_list == handler.ReleaseHeaderList());
+ CHECK(expected_header_list == handler.ReleaseHeaderList());
return 0;
}
diff --git a/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_b_131395084 b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_b_131395084
new file mode 100644
index 0000000..1d8e3d6
--- /dev/null
+++ b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_b_131395084
Binary files differ
diff --git a/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_b_131395084_minimized b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_b_131395084_minimized
new file mode 100644
index 0000000..4ae6054
--- /dev/null
+++ b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_b_131395084_minimized
Binary files differ
diff --git a/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_b_131409242 b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_b_131409242
new file mode 100644
index 0000000..b7e3fe0
--- /dev/null
+++ b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_b_131409242
Binary files differ
diff --git a/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_b_131409242_minimized b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_b_131409242_minimized
new file mode 100644
index 0000000..cc5bce1
--- /dev/null
+++ b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_b_131409242_minimized
Binary files differ
diff --git a/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_crbug_957840 b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_crbug_957840
new file mode 100644
index 0000000..50f2fcb
--- /dev/null
+++ b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_crbug_957840
Binary files differ
diff --git a/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_crbug_957840_minimized b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_crbug_957840_minimized
new file mode 100644
index 0000000..3d48371
--- /dev/null
+++ b/quic/core/qpack/fuzzer/qpack_round_trip_fuzzer_corpus/testcase_crbug_957840_minimized
Binary files differ
