Ignore read data on PendingStream after invalid type byte is received.
This bug has been discovered by Chromium's ClusterFuzz at
https://crbug.com/969391. I locally verified that this CL fixes the crash
with that particular fuzzer input.
https://quicwg.org/base-drafts/draft-ietf-quic-transport.html#frame-stop-sending
notes that a STOP_SENDING frame communicate that "incoming data is being
discarded on receipt". This CL adds a single line to make PendingStream
actually discard incoming data. Before this change, PendingStream could be
tricked into reading further data bytes by retransmitting the original stream
frame, which could have resulted in creating and activating a unidirectional
stream.
gfe-relnote: n/a, change in QUIC v99 only.
PiperOrigin-RevId: 262674708
Change-Id: Icaf0e700711b7220b36e595deb95620cac1d89af
diff --git a/quic/core/quic_stream.h b/quic/core/quic_stream.h
index b747451..c8e5012 100644
--- a/quic/core/quic_stream.h
+++ b/quic/core/quic_stream.h
@@ -78,6 +78,10 @@
void MarkConsumed(size_t num_bytes);
+ // Tells the sequencer to ignore all incoming data itself and not call
+ // OnDataAvailable().
+ void StopReading();
+
private:
friend class QuicStream;
