commit 98ec265f8fdce38b959200d14bb0779187a0d37a
author QUICHE team <quiche-dev@google.com> Fri Aug 27 16:05:55 2021 -0700
committer Copybara-Service <copybara-worker@google.com> Fri Aug 27 16:06:48 2021 -0700
tree 180473949a53dc2061737f87bb588c0b070ffcd8
parent 01fb16f0764b2b364ff6585e9ec625627bdf039e

Returns an error from OnPackExtensionCallback if the extension frame |payload| pointer is nullptr.

PiperOrigin-RevId: 393446531

http2/adapter/nghttp2_callbacks.cc

diff --git a/http2/adapter/nghttp2_callbacks.cc b/http2/adapter/nghttp2_callbacks.cc
index c0a5105..de99302 100644
--- a/http2/adapter/nghttp2_callbacks.cc
+++ b/http2/adapter/nghttp2_callbacks.cc
@@ -11,6 +11,7 @@
 #include "http2/adapter/nghttp2_util.h"
 #include "third_party/nghttp2/nghttp2.h"
 #include "third_party/nghttp2/src/lib/includes/nghttp2/nghttp2.h"
+#include "common/platform/api/quiche_bug_tracker.h"
 #include "common/platform/api/quiche_logging.h"
 #include "common/quiche_endian.h"
 
@@ -268,6 +269,11 @@
                                 void* user_data) {
   QUICHE_CHECK_NE(user_data, nullptr);
   auto* source = static_cast<MetadataSource*>(frame->ext.payload);
+  if (source == nullptr) {
+    QUICHE_BUG(payload_is_nullptr) << "Extension frame payload for stream "
+                                   << frame->hd.stream_id << " is null!";
+    return NGHTTP2_ERR_CALLBACK_FAILURE;
+  }
   const std::pair<int64_t, bool> result = source->Pack(buf, len);
   if (result.first < 0) {
     return NGHTTP2_ERR_CALLBACK_FAILURE;

http2/adapter/nghttp2_session_test.cc

diff --git a/http2/adapter/nghttp2_session_test.cc b/http2/adapter/nghttp2_session_test.cc
index bc49160..2210394 100644
--- a/http2/adapter/nghttp2_session_test.cc
+++ b/http2/adapter/nghttp2_session_test.cc
@@ -6,6 +6,7 @@
 #include "http2/adapter/test_frame_sequence.h"
 #include "http2/adapter/test_utils.h"
 #include "common/platform/api/quiche_test.h"
+#include "common/platform/api/quiche_test_helpers.h"
 
 namespace http2 {
 namespace adapter {
@@ -298,6 +299,23 @@
                                         spdy::SpdyFrameType::PING}));
 }
 
+// Verifies that a null payload is caught by the OnPackExtensionCallback
+// implementation.
+TEST_F(NgHttp2SessionTest, NullPayload) {
+  NgHttp2Session session(Perspective::kClient, CreateCallbacks(), options_,
+                         &visitor_);
+
+  void* payload = nullptr;
+  const int result = nghttp2_submit_extension(
+      session.raw_ptr(), kMetadataFrameType, 0, 1, payload);
+  ASSERT_EQ(0, result);
+  EXPECT_TRUE(session.want_write());
+  int send_result = -1;
+  EXPECT_QUICHE_BUG(send_result = nghttp2_session_send(session.raw_ptr()),
+                    "Extension frame payload for stream 1 is null!");
+  EXPECT_EQ(NGHTTP2_ERR_CALLBACK_FAILURE, send_result);
+}
+
 }  // namespace
 }  // namespace test
 }  // namespace adapter