Disallow invalid MAX_PUSH_ID frame

This frame only contains a variable length integer, so its payload length is not allowed to exceed  8 bytes. Note that gfe2_reloadable_flag_quic_reject_large_max_push_id is default-enabled.

Protected by FLAGS_quic_reloadable_flag_quic_reject_large_max_push_id.

PiperOrigin-RevId: 385247216

quic/core/http/http_decoder.cc

diff --git a/quic/core/http/http_decoder.cc b/quic/core/http/http_decoder.cc
index 92a2e38..b20789b 100644
--- a/quic/core/http/http_decoder.cc
+++ b/quic/core/http/http_decoder.cc
@@ -669,6 +669,13 @@
       return 1024 * 1024;
     case static_cast<uint64_t>(HttpFrameType::GOAWAY):
       return VARIABLE_LENGTH_INTEGER_LENGTH_8;
+    case static_cast<uint64_t>(HttpFrameType::MAX_PUSH_ID):
+      if (GetQuicReloadableFlag(quic_reject_large_max_push_id)) {
+        QUIC_RELOADABLE_FLAG_COUNT(quic_reject_large_max_push_id);
+        return VARIABLE_LENGTH_INTEGER_LENGTH_8;
+      } else {
+        return std::numeric_limits<QuicByteCount>::max();
+      }
     case static_cast<uint64_t>(HttpFrameType::PRIORITY_UPDATE_REQUEST_STREAM):
       // This limit is arbitrary.
       return 1024 * 1024;

quic/core/http/http_decoder_test.cc

diff --git a/quic/core/http/http_decoder_test.cc b/quic/core/http/http_decoder_test.cc
index 36bc2d1..7fa09ba 100644
--- a/quic/core/http/http_decoder_test.cc
+++ b/quic/core/http/http_decoder_test.cc
@@ -603,7 +603,7 @@
   EXPECT_EQ("", decoder_.error_detail());
 }
 
-TEST_F(HttpDecoderTest, MalformedFrameWithOverlyLargePayload) {
+TEST_F(HttpDecoderTest, GoawayWithOverlyLargePayload) {
   std::string input = absl::HexStringToBytes(
       "07"    // type (GOAWAY)
       "10");  // length exceeding the maximum possible length for GOAWAY frame
@@ -614,6 +614,24 @@
   EXPECT_EQ("Frame is too large.", decoder_.error_detail());
 }
 
+TEST_F(HttpDecoderTest, MaxPushIdWithOverlyLargePayload) {
+  std::string input = absl::HexStringToBytes(
+      "0d"    // type (MAX_PUSH_ID)
+      "10");  // length exceeding the maximum possible length for MAX_PUSH_ID
+              // frame
+  // Process all data at once.
+  if (GetQuicReloadableFlag(quic_reject_large_max_push_id)) {
+    EXPECT_CALL(visitor_, OnError(&decoder_));
+    EXPECT_EQ(2u, ProcessInput(input));
+    EXPECT_THAT(decoder_.error(), IsError(QUIC_HTTP_FRAME_TOO_LARGE));
+    EXPECT_EQ("Frame is too large.", decoder_.error_detail());
+  } else {
+    EXPECT_EQ(2u, ProcessInput(input));
+    EXPECT_THAT(decoder_.error(), IsQuicNoError());
+    EXPECT_EQ("", decoder_.error_detail());
+  }
+}
+
 TEST_F(HttpDecoderTest, MalformedSettingsFrame) {
   char input[30];
   QuicDataWriter writer(30, input);

quic/core/quic_flags_list.h

diff --git a/quic/core/quic_flags_list.h b/quic/core/quic_flags_list.h
index 08922c7..002dd3b 100644
--- a/quic/core/quic_flags_list.h
+++ b/quic/core/quic_flags_list.h
@@ -35,6 +35,8 @@
 QUIC_FLAG(FLAGS_quic_reloadable_flag_quic_allow_client_enabled_bbr_v2, false)
 // If true, allow ticket open to be ignored in TlsServerHandshaker. Also fixes TlsServerHandshaker::ResumptionAttempted when handshake hints is used.
 QUIC_FLAG(FLAGS_quic_reloadable_flag_quic_tls_allow_ignore_ticket_open, true)
+// If true, close connection if a MAX_PUSH_ID header with length field exceeding maximum valid payload length of 8 bytes is received.
+QUIC_FLAG(FLAGS_quic_reloadable_flag_quic_reject_large_max_push_id, true)
 // If true, close read side but not write side in QuicSpdyStream::OnStreamReset().
 QUIC_FLAG(FLAGS_quic_reloadable_flag_quic_fix_on_stream_reset, true)
 // If true, default on PTO which unifies TLP + RTO loss recovery.