| Index: net/http/http_stream_parser_fuzzer.cc
|
| diff --git a/net/http/http_stream_parser_fuzzer.cc b/net/http/http_stream_parser_fuzzer.cc
|
| index 52343ac30b93dbec73f69e161c50f9cd68266a53..c58fa9f8554b815afce7466f0c1832efbd745a02 100644
|
| --- a/net/http/http_stream_parser_fuzzer.cc
|
| +++ b/net/http/http_stream_parser_fuzzer.cc
|
| @@ -65,7 +65,10 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
| result = parser.ReadResponseHeaders(callback.callback());
|
| result = callback.GetResult(result);
|
|
|
| - while (result > 0) {
|
| + if (result < 0)
|
| + return 0;
|
| +
|
| + while (true) {
|
| scoped_refptr<net::IOBufferWithSize> io_buffer(
|
| new net::IOBufferWithSize(64));
|
| result = parser.ReadResponseBody(io_buffer.get(), io_buffer->size(),
|
| @@ -74,8 +77,8 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
|
| // Releasing the pointer to IOBuffer immediately is more likely to lead to a
|
| // use-after-free.
|
| io_buffer = nullptr;
|
| -
|
| - result = callback.GetResult(result);
|
| + if (callback.GetResult(result) <= 0)
|
| + break;
|
| }
|
|
|
| return 0;
|
|
|