OLD | NEW |
| (Empty) |
1 // Copyright 2016 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "net/http2/decoder/http2_structure_decoder.h" | |
6 | |
7 #include <algorithm> | |
8 | |
9 #include "net/http2/tools/http2_bug_tracker.h" | |
10 | |
11 namespace net { | |
12 | |
13 // Below we have some defensive coding: if we somehow run off the end, don't | |
14 // overwrite lots of memory. Note that most of this decoder is not defensive | |
15 // against bugs in the decoder, only against malicious encoders, but since | |
16 // we're copying memory into a buffer here, let's make sure we don't allow a | |
17 // small mistake to grow larger. The decoder will get stuck if we hit the | |
18 // HTTP2_BUG conditions, but shouldn't corrupt memory. | |
19 | |
20 uint32_t Http2StructureDecoder::IncompleteStart(DecodeBuffer* db, | |
21 uint32_t target_size) { | |
22 if (target_size > sizeof buffer_) { | |
23 HTTP2_BUG << "target_size too large for buffer: " << target_size; | |
24 return 0; | |
25 } | |
26 const uint32_t num_to_copy = db->MinLengthRemaining(target_size); | |
27 memcpy(buffer_, db->cursor(), num_to_copy); | |
28 offset_ = num_to_copy; | |
29 db->AdvanceCursor(num_to_copy); | |
30 return num_to_copy; | |
31 } | |
32 | |
33 DecodeStatus Http2StructureDecoder::IncompleteStart(DecodeBuffer* db, | |
34 uint32_t* remaining_payload, | |
35 uint32_t target_size) { | |
36 DVLOG(1) << "IncompleteStart@" << this | |
37 << ": *remaining_payload=" << *remaining_payload | |
38 << "; target_size=" << target_size | |
39 << "; db->Remaining=" << db->Remaining(); | |
40 *remaining_payload -= | |
41 IncompleteStart(db, std::min(target_size, *remaining_payload)); | |
42 if (*remaining_payload > 0 && db->Empty()) { | |
43 return DecodeStatus::kDecodeInProgress; | |
44 } | |
45 DVLOG(1) << "IncompleteStart: kDecodeError"; | |
46 return DecodeStatus::kDecodeError; | |
47 } | |
48 | |
49 bool Http2StructureDecoder::ResumeFillingBuffer(DecodeBuffer* db, | |
50 uint32_t target_size) { | |
51 DVLOG(2) << "ResumeFillingBuffer@" << this << ": target_size=" << target_size | |
52 << "; offset_=" << offset_ << "; db->Remaining=" << db->Remaining(); | |
53 if (target_size < offset_) { | |
54 HTTP2_BUG << "Already filled buffer_! target_size=" << target_size | |
55 << " offset_=" << offset_; | |
56 return false; | |
57 } | |
58 const uint32_t needed = target_size - offset_; | |
59 const uint32_t num_to_copy = db->MinLengthRemaining(needed); | |
60 DVLOG(2) << "ResumeFillingBuffer num_to_copy=" << num_to_copy; | |
61 memcpy(&buffer_[offset_], db->cursor(), num_to_copy); | |
62 db->AdvanceCursor(num_to_copy); | |
63 offset_ += num_to_copy; | |
64 return needed == num_to_copy; | |
65 } | |
66 | |
67 bool Http2StructureDecoder::ResumeFillingBuffer(DecodeBuffer* db, | |
68 uint32_t* remaining_payload, | |
69 uint32_t target_size) { | |
70 DVLOG(2) << "ResumeFillingBuffer@" << this << ": target_size=" << target_size | |
71 << "; offset_=" << offset_ | |
72 << "; *remaining_payload=" << *remaining_payload | |
73 << "; db->Remaining=" << db->Remaining(); | |
74 if (target_size < offset_) { | |
75 HTTP2_BUG << "Already filled buffer_! target_size=" << target_size | |
76 << " offset_=" << offset_; | |
77 return false; | |
78 } | |
79 const uint32_t needed = target_size - offset_; | |
80 const uint32_t num_to_copy = | |
81 db->MinLengthRemaining(std::min(needed, *remaining_payload)); | |
82 DVLOG(2) << "ResumeFillingBuffer num_to_copy=" << num_to_copy; | |
83 memcpy(&buffer_[offset_], db->cursor(), num_to_copy); | |
84 db->AdvanceCursor(num_to_copy); | |
85 offset_ += num_to_copy; | |
86 *remaining_payload -= num_to_copy; | |
87 return needed == num_to_copy; | |
88 } | |
89 | |
90 } // namespace net | |
OLD | NEW |