| commit | 8669934fbe32f5ba1817f76acbd1e873c2db1fb8 | [log] [tgz] |
|---|---|---|
| author | QUICHE team <quiche-dev@google.com> | Thu Feb 10 09:06:26 2022 -0800 |
| committer | Copybara-Service <copybara-worker@google.com> | Thu Feb 10 09:07:06 2022 -0800 |
| tree | 6a1738f7dc149d48b2794df9ee4529f83510da60 | |
| parent | 808fab304985df8bb0090d6668ddc1abfe2cb9a7 [diff] |
Fixes integer overflow in OgHttp2Session::UpdateInitialWindowSize(). Before: http://sponge2/319b4db9-8c08-4432-8702-75a90fb964e5 After: http://sponge2/446d71a9-88b7-4696-84a1-3a3701384ca2 PiperOrigin-RevId: 427764038
diff --git a/http2/adapter/oghttp2_session.cc b/http2/adapter/oghttp2_session.cc index 6cdbff7..8a85c36 100644 --- a/http2/adapter/oghttp2_session.cc +++ b/http2/adapter/oghttp2_session.cc
@@ -1768,8 +1768,9 @@ if (new_window_size > spdy::kSpdyMaximumWindowSize) { EnqueueFrame(absl::make_unique<spdy::SpdyRstStreamIR>( stream_id, spdy::ERROR_CODE_FLOW_CONTROL_ERROR)); + } else { + stream_state.send_window += delta; } - stream_state.send_window += delta; if (current_window_size <= 0 && new_window_size > 0) { write_scheduler_.MarkStreamReady(stream_id, false); }