commit 5843bfd652048b9961316a62dbf1cad68e7a55ac
author renjietang <renjietang@google.com> Thu Oct 10 13:24:57 2019 -0700
committer Copybara-Service <copybara-worker@google.com> Thu Oct 10 13:25:22 2019 -0700
tree 0c1b2d1bdbe188bcc544f88e4bb048cc66b3e276
parent a29a96a32deb435116a6532dfc4a6335ece740b8

Fix GOAWAY max frame length.

The stream id of a GOAWAY frame is delivered in varint 62 format. Thus we should allow maximum 8 bytes of frame payload.

gfe-relnote: protected by disabled v99 flag.
PiperOrigin-RevId: 274025730
Change-Id: I1685104558764eb04039bb8502d81495e890cdf1

quic/core/http/http_decoder.cc

diff --git a/quic/core/http/http_decoder.cc b/quic/core/http/http_decoder.cc
index 7fe994e..41632a9 100644
--- a/quic/core/http/http_decoder.cc
+++ b/quic/core/http/http_decoder.cc
@@ -8,6 +8,7 @@
 
 #include "net/third_party/quiche/src/quic/core/http/http_frames.h"
 #include "net/third_party/quiche/src/quic/core/quic_data_reader.h"
+#include "net/third_party/quiche/src/quic/core/quic_types.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_bug_tracker.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_fallthrough.h"
 
@@ -589,7 +590,7 @@
       // This limit is arbitrary.
       return 1024 * 1024;
     case static_cast<uint64_t>(HttpFrameType::GOAWAY):
-      return sizeof(QuicStreamId);
+      return VARIABLE_LENGTH_INTEGER_LENGTH_8;
     case static_cast<uint64_t>(HttpFrameType::MAX_PUSH_ID):
       return sizeof(PushId);
     case static_cast<uint64_t>(HttpFrameType::DUPLICATE_PUSH):

quic/core/http/http_decoder_test.cc

diff --git a/quic/core/http/http_decoder_test.cc b/quic/core/http/http_decoder_test.cc
index 7548f6d..42b4dd2 100644
--- a/quic/core/http/http_decoder_test.cc
+++ b/quic/core/http/http_decoder_test.cc
@@ -4,10 +4,13 @@
 
 #include "net/third_party/quiche/src/quic/core/http/http_decoder.h"
 
+#include <memory>
 #include <utility>
 
 #include "net/third_party/quiche/src/quic/core/http/http_encoder.h"
+#include "net/third_party/quiche/src/quic/core/http/http_frames.h"
 #include "net/third_party/quiche/src/quic/core/quic_data_writer.h"
+#include "net/third_party/quiche/src/quic/core/quic_versions.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_arraysize.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_str_cat.h"
 #include "net/third_party/quiche/src/quic/platform/api/quic_test.h"
@@ -1030,6 +1033,19 @@
   EXPECT_EQ("Unable to read push_id", decoder_.error_detail());
 }
 
+TEST_F(HttpDecoderTest, LargeStreamIdInGoAway) {
+  HttpEncoder encoder;
+  GoAwayFrame frame;
+  frame.stream_id = 1 << 30;
+  std::unique_ptr<char[]> buffer;
+  uint64_t length = encoder.SerializeGoAwayFrame(frame, &buffer);
+  EXPECT_CALL(visitor_, OnGoAwayFrame(frame));
+  EXPECT_GT(length, 0u);
+  EXPECT_EQ(length, decoder_.ProcessInput(buffer.get(), length));
+  EXPECT_EQ(QUIC_NO_ERROR, decoder_.error());
+  EXPECT_EQ("", decoder_.error_detail());
+}
+
 }  // namespace test
 
 }  // namespace quic