QuicStreamSequencer closes the connection on receipt of frames overlapping with buffered data.

net/quic/quic_stream_sequencer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/quic/quic_stream_sequencer.h"
 
 #include <algorithm>
 #include <limits>
 
 #include "base/logging.h"
 #include "base/metrics/sparse_histogram.h"
 #include "net/quic/reliable_quic_stream.h"
 
+using std::make_pair;
 using std::min;
 using std::numeric_limits;
 
 namespace net {
 
 QuicStreamSequencer::QuicStreamSequencer(ReliableQuicStream* quic_stream)
     : stream_(quic_stream),
       num_bytes_consumed_(0),
       close_offset_(numeric_limits<QuicStreamOffset>::max()),
       blocked_(false),
       num_bytes_buffered_(0),
       num_frames_received_(0),
       num_duplicate_frames_received_(0) {
 }
 
 QuicStreamSequencer::~QuicStreamSequencer() {
 }
 
 bool QuicStreamSequencer::OnStreamFrame(const QuicStreamFrame& frame) {
   ++num_frames_received_;
   if (IsDuplicate(frame)) {
     ++num_duplicate_frames_received_;
     // Silently ignore duplicates.
     return true;
   }
 
+  if (FrameOverlapsBufferedData(frame)) {
+    stream_->CloseConnectionWithDetails(
+        QUIC_INVALID_STREAM_FRAME, "Stream frame overlaps with buffered data.");
+    return false;
+  }
+
   QuicStreamOffset byte_offset = frame.offset;
   size_t data_len = frame.data.TotalBufferSize();
   if (data_len == 0 && !frame.fin) {
     // Stream frames must have data or a fin flag.
     stream_->CloseConnectionWithDetails(QUIC_INVALID_STREAM_FRAME,
                                         "Empty stream frame without FIN set.");
     return false;
   }
 
   if (frame.fin) {
@@ skipping 125 matching lines @@
     if (it->second.size() == frame_offset) {
       // We've copied this whole frame
       RecordBytesConsumed(it->second.size());
       buffered_frames_.erase(it);
       it = buffered_frames_.begin();
       frame_offset = 0;
     }
   }
   // We've finished copying.  If we have a partial frame, update it.
   if (frame_offset != 0) {
-    buffered_frames_.insert(make_pair(it->first + frame_offset,
-                             it->second.substr(frame_offset)));
+    buffered_frames_.insert(
+        make_pair(it->first + frame_offset, it->second.substr(frame_offset)));
     buffered_frames_.erase(buffered_frames_.begin());
     RecordBytesConsumed(frame_offset);
   }
   return num_bytes_consumed_ - initial_bytes_consumed;
 }
 
 bool QuicStreamSequencer::HasBytesToRead() const {
   FrameMap::const_iterator it = buffered_frames_.begin();
 
   return it != buffered_frames_.end() && it->first == num_bytes_consumed_;
 }
 
 bool QuicStreamSequencer::IsClosed() const {
   return num_bytes_consumed_ >= close_offset_;
 }
 
+bool QuicStreamSequencer::FrameOverlapsBufferedData(
+    const QuicStreamFrame& frame) const {
+  if (buffered_frames_.empty()) {
+    return false;
+  }
+
+  FrameMap::const_iterator next_frame =
+      buffered_frames_.lower_bound(frame.offset);
+  // Duplicate frames should have been dropped in IsDuplicate.
+  DCHECK(next_frame == buffered_frames_.end() ||
+         next_frame->first != frame.offset);
+
+  // If there is a buffered frame with a higher starting offset, then we check
+  // to see if the new frame runs into the higher frame.
+  if (next_frame != buffered_frames_.end() &&
+      (frame.offset + frame.data.TotalBufferSize()) > next_frame->first) {
+    DVLOG(1) << "New frame overlaps next frame: " << frame.offset << " + "
+             << frame.data.TotalBufferSize() << " > " << next_frame->first;
+    return true;
+  }
+
+  // If there is a buffered frame with a lower starting offset, then we check
+  // to see if the buffered frame runs into the new frame.
+  if (next_frame != buffered_frames_.begin()) {
+    FrameMap::const_iterator preceeding_frame = --next_frame;
+    QuicStreamOffset offset = preceeding_frame->first;
+    uint64 data_length = preceeding_frame->second.length();
+    if ((offset + data_length) > frame.offset) {
+      DVLOG(1) << "Preceeding frame overlaps new frame: " << offset << " + "
+               << data_length << " > " << frame.offset;
+      return true;
+    }
+  }
+  return false;
+}
+
 bool QuicStreamSequencer::IsDuplicate(const QuicStreamFrame& frame) const {
   // A frame is duplicate if the frame offset is smaller than our bytes consumed
   // or we have stored the frame in our map.
   // TODO(pwestin): Is it possible that a new frame contain more data even if
   // the offset is the same?
   return frame.offset < num_bytes_consumed_ ||
       buffered_frames_.find(frame.offset) != buffered_frames_.end();
 }
 
 void QuicStreamSequencer::SetBlockedUntilFlush() {
@@ skipping 29 matching lines @@
 }
 
 void QuicStreamSequencer::RecordBytesConsumed(size_t bytes_consumed) {
   num_bytes_consumed_ += bytes_consumed;
   num_bytes_buffered_ -= bytes_consumed;
 
   stream_->AddBytesConsumed(bytes_consumed);
 }
 
 }  // namespace net