Close connection on incorrect order of HEADERS and DATA frames.
While the HTTP/3 spec draft does not require this yet, this is the sane thing to
do, and my proposal to change the spec has some support:
https://github.com/quicwg/base-drafts/issues/2858.
This fixes fuzzer-found bug https://crbug.com/978733.
NO_BUG=Bug is https://crbug.com/978733 on Chromium bugtracker.
gfe-relnote: n/a, change in QUIC v99-only code.
PiperOrigin-RevId: 257169271
Change-Id: I10ed66e671f0dc03d6f24694d4c53ba3691e9c51
diff --git a/quic/core/http/end_to_end_test.cc b/quic/core/http/end_to_end_test.cc
index 96e5aef..1f8d6cf 100644
--- a/quic/core/http/end_to_end_test.cc
+++ b/quic/core/http/end_to_end_test.cc
@@ -173,6 +173,14 @@
return params;
}
+void WriteHeadersOnStream(QuicSpdyStream* stream) {
+ // Since QuicSpdyStream uses QuicHeaderList::empty() to detect too large
+ // headers, it also fails when receiving empty headers.
+ SpdyHeaderBlock headers;
+ headers["foo"] = "bar";
+ stream->WriteHeaders(std::move(headers), /* fin = */ false, nullptr);
+}
+
class ServerDelegate : public PacketDroppingTestWriter::Delegate {
public:
explicit ServerDelegate(QuicDispatcher* dispatcher)
@@ -1960,6 +1968,7 @@
// Open a data stream to make sure the stream level flow control is updated.
QuicSpdyClientStream* stream = client_->GetOrCreateStream();
+ WriteHeadersOnStream(stream);
stream->WriteOrBufferBody("hello", false);
// Client should have the right values for server's receive window.
@@ -2016,6 +2025,7 @@
// Open a data stream to make sure the stream level flow control is updated.
QuicSpdyClientStream* stream = client_->GetOrCreateStream();
+ WriteHeadersOnStream(stream);
stream->WriteOrBufferBody("hello", false);
// Client should have the right values for server's receive window.
@@ -3564,6 +3574,7 @@
// Set a TTL which expires immediately.
stream->MaybeSetTtl(QuicTime::Delta::FromMicroseconds(1));
+ WriteHeadersOnStream(stream);
// 1 MB body.
std::string body(1024 * 1024, 'a');
stream->WriteOrBufferBody(body, true);
