Stop processing QPACK Header Block Prefix if error is detected.
This fixes the crash https://crbug.com/970218 found by Clusterfuzz.
gfe-relnote: n/a, change in QUIC v99 only.
PiperOrigin-RevId: 253218848
Change-Id: I49c34deefc064bcfe3e6ff86c2975a577d4506f4
diff --git a/quic/core/qpack/qpack_decoder_test.cc b/quic/core/qpack/qpack_decoder_test.cc
index 9aa9d12..eabc7b9 100644
--- a/quic/core/qpack/qpack_decoder_test.cc
+++ b/quic/core/qpack/qpack_decoder_test.cc
@@ -551,6 +551,15 @@
DecodeHeaderBlock(QuicTextUtils::HexDecode("4100"));
}
+// Regression test for https://crbug.com/970218: Decoder must stop processing
+// after a Header Block Prefix with an invalid Encoded Required Insert Count.
+TEST_P(QpackDecoderTest, DataAfterInvalidEncodedRequiredInsertCount) {
+ EXPECT_CALL(handler_, OnDecodingErrorDetected(
+ Eq("Error decoding Required Insert Count.")));
+ // Header Block Prefix followed by some extra data.
+ DecodeHeaderBlock(QuicTextUtils::HexDecode("410000"));
+}
+
TEST_P(QpackDecoderTest, WrappedRequiredInsertCount) {
// Maximum dynamic table capacity is 1024.
// MaxEntries is 1024 / 32 = 32.
diff --git a/quic/core/qpack/qpack_progressive_decoder.cc b/quic/core/qpack/qpack_progressive_decoder.cc
index 05a5fc0..5a60084 100644
--- a/quic/core/qpack/qpack_progressive_decoder.cc
+++ b/quic/core/qpack/qpack_progressive_decoder.cc
@@ -94,6 +94,10 @@
// decoded.
while (!prefix_decoded_) {
prefix_decoder_->Decode(data.substr(0, 1));
+ if (error_detected_) {
+ return;
+ }
+
data = data.substr(1);
if (data.empty()) {
return;
