Index: net/quic/quic_framer.cc |
diff --git a/net/quic/quic_framer.cc b/net/quic/quic_framer.cc |
index 588db7483ed4c689284962f34eaf8e200c1f9fe0..90d9a89b829ab59946dd2797bb42ad2748e40af3 100644 |
--- a/net/quic/quic_framer.cc |
+++ b/net/quic/quic_framer.cc |
@@ -2049,6 +2049,15 @@ bool QuicFramer::AppendAckFrameAndTypeByte( |
DCHECK_GE(header.packet_sequence_number, frame.sent_info.least_unacked); |
const QuicPacketSequenceNumber least_unacked_delta = |
header.packet_sequence_number - frame.sent_info.least_unacked; |
+ const QuicPacketSequenceNumber length_shift = |
+ header.public_header.sequence_number_length * 8; |
+ if (least_unacked_delta >> length_shift > 0) { |
+ LOG(DFATAL) << "sequence_number_length " |
+ << header.public_header.sequence_number_length |
+ << " is too small for least_unacked_delta: " |
+ << least_unacked_delta; |
+ return false; |
+ } |
if (!AppendPacketSequenceNumber(header.public_header.sequence_number_length, |
least_unacked_delta, writer)) { |
return false; |