SPDY: Handle incorrect number of headers when parsing frame headers.

net/spdy/spdy_framer_test.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 #include <iostream>
 
 #include "base/scoped_ptr.h"
 #include "net/spdy/spdy_framer.h"
 #include "net/spdy/spdy_protocol.h"
@@ skipping 130 matching lines @@
   headers["alpha"] = "beta";
   headers["gamma"] = "charlie";
   SpdyFramer framer;
 
   // Encode the header block into a SynStream frame.
   scoped_ptr<SpdySynStreamControlFrame> frame(
       framer.CreateSynStream(1, 0, 1, CONTROL_FLAG_NONE, true, &headers));
   EXPECT_TRUE(frame.get() != NULL);
 
   SpdyHeaderBlock new_headers;
-  framer.ParseHeaderBlock(frame.get(), &new_headers);
+  EXPECT_TRUE(framer.ParseHeaderBlock(frame.get(), &new_headers));
 
   EXPECT_EQ(headers.size(), new_headers.size());
   EXPECT_EQ(headers["alpha"], new_headers["alpha"]);
   EXPECT_EQ(headers["gamma"], new_headers["gamma"]);
 }
 
 TEST_F(SpdyFramerTest, OutOfOrderHeaders) {
   SpdyFrameBuilder frame;
 
   frame.WriteUInt16(kControlFlagMask | 1);
   frame.WriteUInt16(SYN_STREAM);
   frame.WriteUInt32(0);  // Placeholder for the length.
   frame.WriteUInt32(3);  // stream_id
+  frame.WriteUInt32(0);  // associated stream id
   frame.WriteUInt16(0);  // Priority.
 
   frame.WriteUInt16(2);  // Number of headers.
   SpdyHeaderBlock::iterator it;
   frame.WriteString("gamma");
   frame.WriteString("gamma");
   frame.WriteString("alpha");
   frame.WriteString("alpha");
   // write the length
   frame.WriteUInt32ToOffset(4, frame.length() - SpdyFrame::size());
 
   SpdyHeaderBlock new_headers;
   scoped_ptr<SpdyFrame> control_frame(frame.take());
   SpdyFramer framer;
   FramerSetEnableCompressionHelper(&framer, false);
   EXPECT_TRUE(framer.ParseHeaderBlock(control_frame.get(), &new_headers));
 }
 
+TEST_F(SpdyFramerTest, WrongNumberOfHeaders) {
+  SpdyFrameBuilder frame1;
+  SpdyFrameBuilder frame2;
+
+  // a frame with smaller number of actual headers
+  frame1.WriteUInt16(kControlFlagMask | 1);
+  frame1.WriteUInt16(SYN_STREAM);
+  frame1.WriteUInt32(0);  // Placeholder for the length.
+  frame1.WriteUInt32(3);  // stream_id
+  frame1.WriteUInt32(0);  // associated stream id
+  frame1.WriteUInt16(0);  // Priority.
+
+  frame1.WriteUInt16(1);  // Wrong number of headers (underflow)
+  frame1.WriteString("gamma");
+  frame1.WriteString("gamma");
+  frame1.WriteString("alpha");
+  frame1.WriteString("alpha");
+  // write the length
+  frame1.WriteUInt32ToOffset(4, frame1.length() - SpdyFrame::size());
+
+  // a frame with larger number of actual headers
+  frame2.WriteUInt16(kControlFlagMask | 1);
+  frame2.WriteUInt16(SYN_STREAM);
+  frame2.WriteUInt32(0);  // Placeholder for the length.
+  frame2.WriteUInt32(3);  // stream_id
+  frame2.WriteUInt32(0);  // associated stream id
+  frame2.WriteUInt16(0);  // Priority.
+
+  frame2.WriteUInt16(100);  // Wrong number of headers (overflow)
+  frame2.WriteString("gamma");
+  frame2.WriteString("gamma");
+  frame2.WriteString("alpha");
+  frame2.WriteString("alpha");
+  // write the length
+  frame2.WriteUInt32ToOffset(4, frame2.length() - SpdyFrame::size());
+
+  SpdyHeaderBlock new_headers;
+  scoped_ptr<SpdyFrame> syn_frame1(frame1.take());
+  scoped_ptr<SpdyFrame> syn_frame2(frame2.take());
+  SpdyFramer framer;
+  FramerSetEnableCompressionHelper(&framer, false);
+  EXPECT_FALSE(framer.ParseHeaderBlock(syn_frame1.get(), &new_headers));
+  EXPECT_FALSE(framer.ParseHeaderBlock(syn_frame2.get(), &new_headers));
+}
+
 TEST_F(SpdyFramerTest, DuplicateHeader) {
   SpdyFrameBuilder frame;
 
   frame.WriteUInt16(kControlFlagMask | 1);
   frame.WriteUInt16(SYN_STREAM);
   frame.WriteUInt32(0);  // Placeholder for the length.
   frame.WriteUInt32(3);  // stream_id
   frame.WriteUInt32(0);  // associated stream id
   frame.WriteUInt16(0);  // Priority.
 
@@ skipping 17 matching lines @@
 TEST_F(SpdyFramerTest, MultiValueHeader) {
   SpdyFrameBuilder frame;
 
   frame.WriteUInt16(kControlFlagMask | 1);
   frame.WriteUInt16(SYN_STREAM);
   frame.WriteUInt32(0);  // Placeholder for the length.
   frame.WriteUInt32(3);  // stream_id
   frame.WriteUInt32(0);  // associated stream id
   frame.WriteUInt16(0);  // Priority.
 
-  frame.WriteUInt16(2);  // Number of headers.
+  frame.WriteUInt16(1);  // Number of headers.
   SpdyHeaderBlock::iterator it;
   frame.WriteString("name");
   std::string value("value1\0value2");
   frame.WriteString(value);
   // write the length
   frame.WriteUInt32ToOffset(4, frame.length() - SpdyFrame::size());
 
   SpdyHeaderBlock new_headers;
   scoped_ptr<SpdyFrame> control_frame(frame.take());
   SpdyFramer framer;
@@ skipping 188 matching lines @@
   const unsigned char input[] = {
     0x80, 0x01, 0x00, 0x01,   // SYN Stream #1
     0x00, 0x00, 0x00, 0x14,
     0x00, 0x00, 0x00, 0x01,
     0x00, 0x00, 0x00, 0x00,
     0x00, 0x00, 0x00, 0x01,
     0x00, 0x02, 'h', 'h',
     0x00, 0x02, 'v', 'v',
 
     0x80, 0x01, 0x00, 0x02,   // SYN REPLY Stream #1
-    0x01, 0x00, 0x00, 0x14,
+    0x01, 0x00, 0x00, 0x10,
     0x00, 0x00, 0x00, 0x01,
-    0x00, 0x00, 0x00, 0x00,
     0x00, 0x00, 0x00, 0x01,
     0x00, 0x02, 'a', 'a',
     0x00, 0x02, 'b', 'b',
   };
 
   TestSpdyVisitor visitor;
   visitor.SimulateInFramer(input, sizeof(input));
 
   EXPECT_EQ(0, visitor.error_count_);
   EXPECT_EQ(1, visitor.syn_frame_count_);
@@ skipping 98 matching lines @@
   EXPECT_EQ(2, send_framer.num_stream_compressors());
   EXPECT_EQ(0, send_framer.num_stream_decompressors());
   EXPECT_EQ(0, recv_framer.num_stream_compressors());
   EXPECT_EQ(2, recv_framer.num_stream_decompressors());
 }
 
 // Verify we don't leak when we leave streams unclosed
 TEST_F(SpdyFramerTest, UnclosedStreamDataCompressors) {
   SpdyFramer send_framer;
 
-  FramerSetEnableCompressionHelper(&send_framer, true);
+  FramerSetEnableCompressionHelper(&send_framer, false);
 
   const char kHeader1[] = "header1";
   const char kHeader2[] = "header2";
   const char kValue1[] = "value1";
   const char kValue2[] = "value2";
 
   SpdyHeaderBlock block;
   block[kHeader1] = kValue1;
   block[kHeader2] = kValue2;
   SpdyControlFlags flags(CONTROL_FLAG_NONE);
   scoped_ptr<spdy::SpdyFrame> syn_frame(
       send_framer.CreateSynStream(1, 0, 0, flags, true, &block));
   EXPECT_TRUE(syn_frame.get() != NULL);
 
   const char bytes[] = "this is a test test test test test!";
   scoped_ptr<SpdyFrame> send_frame(
       send_framer.CreateDataFrame(1, bytes, arraysize(bytes),
-                                  DATA_FLAG_FIN | DATA_FLAG_COMPRESSED));
+                                  DATA_FLAG_FIN));
   EXPECT_TRUE(send_frame.get() != NULL);
 
   // Run the inputs through the framer.
   TestSpdyVisitor visitor;
   const unsigned char* data;
   data = reinterpret_cast<const unsigned char*>(syn_frame->data());
   visitor.SimulateInFramer(data, syn_frame->length() + SpdyFrame::size());
   data = reinterpret_cast<const unsigned char*>(send_frame->data());
   visitor.SimulateInFramer(data, send_frame->length() + SpdyFrame::size());
 
   EXPECT_EQ(0, visitor.error_count_);
   EXPECT_EQ(1, visitor.syn_frame_count_);
   EXPECT_EQ(0, visitor.syn_reply_frame_count_);
   EXPECT_EQ(arraysize(bytes), static_cast<unsigned>(visitor.data_bytes_));
   EXPECT_EQ(0, visitor.fin_frame_count_);
   EXPECT_EQ(0, visitor.fin_flag_count_);
   EXPECT_EQ(1, visitor.zero_length_data_frame_count_);
 
   // We closed the streams, so all compressors should be down.
   EXPECT_EQ(0, visitor.framer_.num_stream_compressors());
   EXPECT_EQ(0, visitor.framer_.num_stream_decompressors());
   EXPECT_EQ(0, send_framer.num_stream_compressors());
   EXPECT_EQ(0, send_framer.num_stream_decompressors());
 }
 
 }  // namespace