SPDY: Fix flaky padding edge case.

net/spdy/spdy_framer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // TODO(rtenhove) clean up frame buffer size calculations so that we aren't
 // constantly adding and subtracting header sizes; this is ugly and error-
 // prone.
 
 #include "net/spdy/spdy_framer.h"
 
@@ skipping 546 matching lines @@
         break;
       }
 
       case SPDY_CONSUME_PADDING: {
         size_t bytes_read = ProcessFramePadding(data, len);
         len -= bytes_read;
         data += bytes_read;
         break;
       }
 
-      case SPDY_IGNORE_REMAINING_PAYLOAD:
-        // control frame has too-large payload
-        // intentional fallthrough
+      case SPDY_IGNORE_REMAINING_PAYLOAD: {
+        size_t bytes_read = ProcessIgnoredControlFramePayload(/*data,*/ len);
+        len -= bytes_read;
+        data += bytes_read;
+        break;
+      }
+
       case SPDY_FORWARD_STREAM_FRAME: {
         size_t bytes_read = ProcessDataFramePayload(data, len);
         len -= bytes_read;
         data += bytes_read;
         break;
       }
+
       default:
         LOG(DFATAL) << "Invalid value for " << display_protocol_
                     << " framer state: " << state_;
         // This ensures that we don't infinite-loop if state_ gets an
         // invalid value somehow, such as due to a SpdyFramer getting deleted
         // from a callback it calls.
         goto bottom;
     }
   } while (state_ != previous_state_);
  bottom:
@@ skipping 1315 matching lines @@
     // Communicate the padding to the visitor through a NULL data pointer, with
     // a nonzero size.
     if (amount_to_discard) {
       visitor_->OnStreamFrameData(
           current_frame_stream_id_, NULL, amount_to_discard, false);
     }
     data += amount_to_discard;
     len -= amount_to_discard;
     remaining_padding_payload_length_ -= amount_to_discard;
     remaining_data_length_ -= amount_to_discard;
-
-    // If the FIN flag is set, and there is no more data in this data
-    // frame, inform the visitor of EOF via a 0-length data frame.
-    if (!remaining_data_length_ && current_frame_flags_ & DATA_FLAG_FIN) {
-      visitor_->OnStreamFrameData(current_frame_stream_id_, NULL, 0, true);
-    }
   }
 
   if (remaining_data_length_ == 0) {
+    // If the FIN flag is set, and there is no more data in this data frame,
+    // inform the visitor of EOF via a 0-length data frame.
+    if (current_frame_flags_ & DATA_FLAG_FIN) {
+      visitor_->OnStreamFrameData(current_frame_stream_id_, NULL, 0, true);
+    }
+
     CHANGE_STATE(SPDY_AUTO_RESET);
   }
   return original_len - len;
 }
 
 size_t SpdyFramer::ProcessDataFramePayload(const char* data, size_t len) {
   size_t original_len = len;
   if (remaining_data_length_ - remaining_padding_payload_length_ > 0) {
     size_t amount_to_forward = std::min(
         remaining_data_length_ - remaining_padding_payload_length_, len);
     if (amount_to_forward && state_ != SPDY_IGNORE_REMAINING_PAYLOAD) {
       // Only inform the visitor if there is data.
       if (amount_to_forward) {
         visitor_->OnStreamFrameData(
             current_frame_stream_id_, data, amount_to_forward, false);
       }
     }
     data += amount_to_forward;
     len -= amount_to_forward;
     remaining_data_length_ -= amount_to_forward;
-
-    // If the FIN flag is set, and there is no more data in this data
-    // frame, inform the visitor of EOF via a 0-length data frame.
-    if (!remaining_data_length_ && current_frame_flags_ & DATA_FLAG_FIN) {
-      visitor_->OnStreamFrameData(current_frame_stream_id_, NULL, 0, true);
-    }
   }
 
   if (remaining_data_length_ == remaining_padding_payload_length_) {
     CHANGE_STATE(SPDY_CONSUME_PADDING);
   }
   return original_len - len;
 }
 
+size_t SpdyFramer::ProcessIgnoredControlFramePayload(/*const char* data,*/
+                                                     size_t len) {
+  size_t original_len = len;
+  if (remaining_data_length_ > 0) {
+    size_t amount_to_ignore = std::min(remaining_data_length_, len);
+    len -= amount_to_ignore;
+    remaining_data_length_ -= amount_to_ignore;
+  }
+
+  if (remaining_data_length_ == 0) {
+    CHANGE_STATE(SPDY_AUTO_RESET);
+  }
+  return original_len - len;
+}
+
 size_t SpdyFramer::ParseHeaderBlockInBuffer(const char* header_data,
                                           size_t header_length,
                                           SpdyHeaderBlock* block) const {
   SpdyFrameReader reader(header_data, header_length);
 
   // Read number of headers.
   uint32 num_headers;
   if (protocol_version() <= SPDY2) {
     uint16 temp;
     if (!reader.ReadUInt16(&temp)) {
@@ skipping 979 matching lines @@
   builder->Seek(compressed_size);
   builder->RewriteLength(*this);
 
   pre_compress_bytes.Add(uncompressed_len);
   post_compress_bytes.Add(compressed_size);
 
   compressed_frames.Increment();
 }
 
 }  // namespace net