SPDY: Fix flaky padding edge case.

net/spdy/spdy_framer.cc

Index: net/spdy/spdy_framer.cc
diff --git a/net/spdy/spdy_framer.cc b/net/spdy/spdy_framer.cc
index 321c31a027899ad009c2ca3ecfb2186979201c24..378c64002ec084f14792a2b915722061e85f0a32 100644
--- a/net/spdy/spdy_framer.cc
+++ b/net/spdy/spdy_framer.cc
@@ -564,15 +564,20 @@ size_t SpdyFramer::ProcessInput(const char* data, size_t len) {
         break;
       }
 
-      case SPDY_IGNORE_REMAINING_PAYLOAD:
-        // control frame has too-large payload
-        // intentional fallthrough
+      case SPDY_IGNORE_REMAINING_PAYLOAD: {
+        size_t bytes_read = ProcessIgnoredControlFramePayload(/*data,*/ len);
+        len -= bytes_read;
+        data += bytes_read;
+        break;
+      }
+
       case SPDY_FORWARD_STREAM_FRAME: {
         size_t bytes_read = ProcessDataFramePayload(data, len);
         len -= bytes_read;
         data += bytes_read;
         break;
       }
+
       default:
         LOG(DFATAL) << "Invalid value for " << display_protocol_
                     << " framer state: " << state_;
@@ -1908,15 +1913,15 @@ size_t SpdyFramer::ProcessFramePadding(const char* data, size_t len) {
     len -= amount_to_discard;
     remaining_padding_payload_length_ -= amount_to_discard;
     remaining_data_length_ -= amount_to_discard;
+  }
 
-    // If the FIN flag is set, and there is no more data in this data
-    // frame, inform the visitor of EOF via a 0-length data frame.
-    if (!remaining_data_length_ && current_frame_flags_ & DATA_FLAG_FIN) {
+  if (remaining_data_length_ == 0) {
+    // If the FIN flag is set, and there is no more data in this data frame,
+    // inform the visitor of EOF via a 0-length data frame.
+    if (current_frame_flags_ & DATA_FLAG_FIN) {
       visitor_->OnStreamFrameData(current_frame_stream_id_, NULL, 0, true);
     }
-  }
 
-  if (remaining_data_length_ == 0) {
     CHANGE_STATE(SPDY_AUTO_RESET);
   }
   return original_len - len;
@@ -1937,12 +1942,6 @@ size_t SpdyFramer::ProcessDataFramePayload(const char* data, size_t len) {
     data += amount_to_forward;
     len -= amount_to_forward;
     remaining_data_length_ -= amount_to_forward;
-
-    // If the FIN flag is set, and there is no more data in this data
-    // frame, inform the visitor of EOF via a 0-length data frame.
-    if (!remaining_data_length_ && current_frame_flags_ & DATA_FLAG_FIN) {
-      visitor_->OnStreamFrameData(current_frame_stream_id_, NULL, 0, true);
-    }
   }
 
   if (remaining_data_length_ == remaining_padding_payload_length_) {
@@ -1951,6 +1950,21 @@ size_t SpdyFramer::ProcessDataFramePayload(const char* data, size_t len) {
   return original_len - len;
 }
 
+size_t SpdyFramer::ProcessIgnoredControlFramePayload(/*const char* data,*/
+                                                     size_t len) {
+  size_t original_len = len;
+  if (remaining_data_length_ > 0) {
+    size_t amount_to_ignore = std::min(remaining_data_length_, len);
+    len -= amount_to_ignore;
+    remaining_data_length_ -= amount_to_ignore;
+  }
+
+  if (remaining_data_length_ == 0) {
+    CHANGE_STATE(SPDY_AUTO_RESET);
+  }
+  return original_len - len;
+}
+
 size_t SpdyFramer::ParseHeaderBlockInBuffer(const char* header_data,
                                           size_t header_length,
                                           SpdyHeaderBlock* block) const {