commit 3371b09895d17ce15d1390bb607f735ccb36086c
author fayang <fayang@google.com> Wed Dec 04 07:08:52 2019 -0800
committer Copybara-Service <copybara-worker@google.com> Wed Dec 04 07:09:32 2019 -0800
tree c46900efb91e1e89f4cee3af880697f30de157f6
parent 4cd745db9d9ea6945e776cb16c62f58bbf4883b8

gfe-relnote: Fix an unsigned integer overflow bug in QUIC v99 when processing Ack frame. Not used in prod. Not protected.

PiperOrigin-RevId: 283749707
Change-Id: I0da7578f275146448a29c497c52074e97a257240

quic/core/quic_framer.cc

diff --git a/quic/core/quic_framer.cc b/quic/core/quic_framer.cc
index fdb2074..c5708b9 100644
--- a/quic/core/quic_framer.cc
+++ b/quic/core/quic_framer.cc
@@ -3656,7 +3656,7 @@
     return false;
   }
 
-  if (ack_delay_time_in_us == kVarInt62MaxValue) {
+  if (ack_delay_time_in_us >= (kVarInt62MaxValue >> peer_ack_delay_exponent_)) {
     ack_frame->ack_delay_time = QuicTime::Delta::Infinite();
   } else {
     ack_delay_time_in_us = (ack_delay_time_in_us << peer_ack_delay_exponent_);