Deprecate HTTP/2 PAD_HIGH field and enforce max padding size to 256 octets.

net/spdy/spdy_framer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_framer.h"
 
 #include "base/lazy_instance.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/stats_counters.h"
 #include "base/third_party/valgrind/memcheck.h"
@@ skipping 148 matching lines @@
   remaining_data_length_ = 0;
   remaining_control_header_ = 0;
   current_frame_buffer_length_ = 0;
   current_frame_type_ = DATA;
   current_frame_flags_ = 0;
   current_frame_length_ = 0;
   current_frame_stream_id_ = kInvalidStream;
   settings_scratch_.Reset();
   altsvc_scratch_.Reset();
   remaining_padding_payload_length_ = 0;
-  remaining_padding_length_fields_ = 0;
 }
 
 size_t SpdyFramer::GetDataFrameMinimumSize() const {
   return SpdyConstants::GetDataFrameMinimumSize();
 }
 
 // Size, in bytes, of the control frame header.
 size_t SpdyFramer::GetControlFrameHeaderSize() const {
   return SpdyConstants::GetControlFrameHeaderSize(protocol_version());
 }
@@ skipping 594 matching lines @@
   // if we're here, then we have the common header all received.
   if (!is_control_frame) {
     if (protocol_version() > SPDY3) {
       // Catch bogus tests sending oversized DATA frames.
       DCHECK_GE(GetFrameMaximumSize(), current_frame_length_)
           << "DATA frame too large for SPDY >= 4.";
     }
 
     uint8 valid_data_flags = 0;
     if (protocol_version() > SPDY3) {
-      valid_data_flags = DATA_FLAG_FIN | DATA_FLAG_END_SEGMENT |
-          DATA_FLAG_PAD_LOW | DATA_FLAG_PAD_HIGH;
+      valid_data_flags =
+          DATA_FLAG_FIN | DATA_FLAG_END_SEGMENT | DATA_FLAG_PADDED;
     } else {
       valid_data_flags = DATA_FLAG_FIN;
     }
 
     if (current_frame_flags_ & ~valid_data_flags) {
       set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
     } else {
       visitor_->OnDataFrameHeader(current_frame_stream_id_,
                                   remaining_data_length_,
                                   current_frame_flags_ & DATA_FLAG_FIN);
@@ skipping 134 matching lines @@
         }
         if (current_frame_length_ < min_size) {
           set_error(SPDY_INVALID_CONTROL_FRAME);
         } else if (protocol_version() <= SPDY3 &&
                    current_frame_flags_ & ~CONTROL_FLAG_FIN) {
           set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
         } else if (protocol_version() > SPDY3 &&
                    current_frame_flags_ &
                        ~(CONTROL_FLAG_FIN | HEADERS_FLAG_PRIORITY |
                          HEADERS_FLAG_END_HEADERS | HEADERS_FLAG_END_SEGMENT |
-                         HEADERS_FLAG_PAD_LOW | HEADERS_FLAG_PAD_HIGH)) {
+                         HEADERS_FLAG_PADDED)) {
           set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
         }
       }
       break;
     case WINDOW_UPDATE:
       if (current_frame_length_ != GetWindowUpdateSize()) {
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (current_frame_flags_ != 0) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     case BLOCKED:
       if (current_frame_length_ != GetBlockedSize() ||
           protocol_version() <= SPDY3) {
         // TODO(mlavan): BLOCKED frames are no longer part of SPDY4.
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (current_frame_flags_ != 0) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     case PUSH_PROMISE:
       if (current_frame_length_ < GetPushPromiseMinimumSize()) {
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (protocol_version() <= SPDY3 && current_frame_flags_ != 0) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       } else if (protocol_version() > SPDY3 &&
                  current_frame_flags_ &
                      ~(PUSH_PROMISE_FLAG_END_PUSH_PROMISE |
-                       HEADERS_FLAG_PAD_LOW | HEADERS_FLAG_PAD_HIGH)) {
+                       HEADERS_FLAG_PADDED)) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
       break;
     case CONTINUATION:
       if (current_frame_length_ < GetContinuationMinimumSize() ||
           protocol_version() <= SPDY3) {
         set_error(SPDY_INVALID_CONTROL_FRAME);
       } else if (current_frame_flags_ & ~HEADERS_FLAG_END_HEADERS) {
         set_error(SPDY_INVALID_CONTROL_FRAME_FLAGS);
       }
@@ skipping 1090 matching lines @@
                        StringPiece(altsvc_scratch_.host.get(),
                                    altsvc_scratch_.host_len),
                        StringPiece(altsvc_scratch_.origin.get(),
                                    altsvc_scratch_.origin_len));
     CHANGE_STATE(SPDY_AUTO_RESET);
   }
 
   return processed_bytes;
 }
 
+// TODO(raullenchai): ProcessFramePaddingLength should be able to deal with
+// HEADERS_FLAG_PADDED and PUSH_PROMISE_FLAG_PADDED as well (see b/15777051).
 size_t SpdyFramer::ProcessFramePaddingLength(const char* data, size_t len) {
   DCHECK_EQ(SPDY_READ_PADDING_LENGTH, state_);
+  DCHECK_EQ(remaining_padding_payload_length_, 0u);
 
   size_t original_len = len;
-  if (remaining_padding_length_fields_ == 0) {
-    DCHECK_EQ(remaining_padding_payload_length_, 0u);
-    bool pad_low = false;
-    bool pad_high = false;
-    if (current_frame_flags_ & DATA_FLAG_PAD_LOW) {
-      pad_low = true;
-      ++remaining_padding_length_fields_;
-    }
-    if (current_frame_flags_ & DATA_FLAG_PAD_HIGH) {
-      pad_high = true;
-      ++remaining_padding_length_fields_;
-    }
-    if ((pad_high && !pad_low) ||
-        remaining_data_length_ < remaining_padding_length_fields_) {
-      set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
+  if (current_frame_flags_ & DATA_FLAG_PADDED) {
+    if (len != 0) {
+      if (remaining_data_length_ < 1) {
+        set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
+        return 0;
+      }
+
+      remaining_padding_payload_length_ = *reinterpret_cast<const uint8*>(data);
+      ++data;
+      --len;
+      --remaining_data_length_;
+    } else {
+      // We don't have the data available for parsing the pad length field. Keep
+      // waiting.
       return 0;
     }
   }
 
-  // Parse the padding length.
-  while (len != 0 && remaining_padding_length_fields_ != 0) {
-    remaining_padding_payload_length_ =
-        (remaining_padding_payload_length_ << 8) +
-        *reinterpret_cast<const uint8*>(data);
-    ++data;
-    --len;
-    --remaining_padding_length_fields_;
-    --remaining_data_length_;
+  if (remaining_padding_payload_length_ > remaining_data_length_) {
+    set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
+    return 0;
   }
-
-  if (remaining_padding_length_fields_ == 0) {
-    if (remaining_padding_payload_length_ > remaining_data_length_) {
-      set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
-      return 0;
-    }
-    if (current_frame_type_ == DATA) {
-      CHANGE_STATE(SPDY_FORWARD_STREAM_FRAME);
-    } else {
-      DCHECK(current_frame_type_ == HEADERS ||
-             current_frame_type_ == PUSH_PROMISE ||
-             current_frame_type_ == SYN_STREAM ||
-             current_frame_type_ == SYN_REPLY)
-          << current_frame_type_;
-      CHANGE_STATE(SPDY_CONTROL_FRAME_HEADER_BLOCK);
-    }
+  if (current_frame_type_ == DATA) {
+    CHANGE_STATE(SPDY_FORWARD_STREAM_FRAME);
+  } else {
+    DCHECK(current_frame_type_ == HEADERS ||
+           current_frame_type_ == PUSH_PROMISE ||
+           current_frame_type_ == SYN_STREAM ||
+           current_frame_type_ == SYN_REPLY)
+        << current_frame_type_;
+    CHANGE_STATE(SPDY_CONTROL_FRAME_HEADER_BLOCK);
   }
   return original_len - len;
 }
 
 size_t SpdyFramer::ProcessFramePadding(const char* data, size_t len) {
   DCHECK_EQ(SPDY_CONSUME_PADDING, state_);
 
   size_t original_len = len;
   if (remaining_padding_payload_length_ > 0) {
     DCHECK_EQ(remaining_padding_payload_length_, remaining_data_length_);
@@ skipping 121 matching lines @@
 
 SpdySerializedFrame* SpdyFramer::SerializeData(
     const SpdyDataIR& data_ir) const {
   uint8 flags = DATA_FLAG_NONE;
   if (data_ir.fin()) {
     flags = DATA_FLAG_FIN;
   }
 
   if (protocol_version() > SPDY3) {
     int num_padding_fields = 0;
-    if (data_ir.pad_low()) {
-      flags |= DATA_FLAG_PAD_LOW;
-      ++num_padding_fields;
-    }
-    if (data_ir.pad_high()) {
-      flags |= DATA_FLAG_PAD_HIGH;
+    if (data_ir.padded()) {
+      flags |= DATA_FLAG_PADDED;
       ++num_padding_fields;
     }
 
     const size_t size_with_padding = num_padding_fields +
         data_ir.data().length() + data_ir.padding_payload_len() +
         GetDataFrameMinimumSize();
     SpdyFrameBuilder builder(size_with_padding, protocol_version());
     builder.WriteDataFrameHeader(*this, data_ir.stream_id(), flags);
-    if (data_ir.pad_high()) {
-      builder.WriteUInt8(data_ir.padding_payload_len() >> 8);
-    }
-    if (data_ir.pad_low()) {
+    if (data_ir.padded()) {
       builder.WriteUInt8(data_ir.padding_payload_len() & 0xff);
     }
     builder.WriteBytes(data_ir.data().data(), data_ir.data().length());
     if (data_ir.padding_payload_len() > 0) {
       string padding = string(data_ir.padding_payload_len(), '0');
       builder.WriteBytes(padding.data(), padding.length());
     }
     DCHECK_EQ(size_with_padding, builder.length());
     return builder.take();
   } else {
     const size_t size = GetDataFrameMinimumSize() + data_ir.data().length();
     SpdyFrameBuilder builder(size, protocol_version());
     builder.WriteDataFrameHeader(*this, data_ir.stream_id(), flags);
     builder.WriteBytes(data_ir.data().data(), data_ir.data().length());
     DCHECK_EQ(size, builder.length());
     return builder.take();
   }
 }
 
 SpdySerializedFrame* SpdyFramer::SerializeDataFrameHeaderWithPaddingLengthField(
     const SpdyDataIR& data_ir) const {
   uint8 flags = DATA_FLAG_NONE;
   if (data_ir.fin()) {
     flags = DATA_FLAG_FIN;
   }
 
   size_t frame_size = GetDataFrameMinimumSize();
   size_t num_padding_fields = 0;
   if (protocol_version() > SPDY3) {
-    if (data_ir.pad_low()) {
-      flags |= DATA_FLAG_PAD_LOW;
-      ++num_padding_fields;
-    }
-    if (data_ir.pad_high()) {
-      flags |= DATA_FLAG_PAD_HIGH;
+    if (data_ir.padded()) {
+      flags |= DATA_FLAG_PADDED;
       ++num_padding_fields;
     }
     frame_size += num_padding_fields;
   }
 
   SpdyFrameBuilder builder(frame_size, protocol_version());
   builder.WriteDataFrameHeader(*this, data_ir.stream_id(), flags);
   if (protocol_version() > SPDY3) {
-    if (data_ir.pad_high()) {
-      builder.WriteUInt8(data_ir.padding_payload_len() >> 8);
-    }
-    if (data_ir.pad_low()) {
+    if (data_ir.padded()) {
       builder.WriteUInt8(data_ir.padding_payload_len() & 0xff);
     }
     builder.OverwriteLength(*this,  num_padding_fields +
         data_ir.data().length() + data_ir.padding_payload_len());
   } else {
     builder.OverwriteLength(*this, data_ir.data().length());
   }
   DCHECK_EQ(frame_size, builder.length());
   return builder.take();
 }
@@ skipping 878 matching lines @@
   builder->Seek(compressed_size);
   builder->RewriteLength(*this);
 
   pre_compress_bytes.Add(uncompressed_len);
   post_compress_bytes.Add(compressed_size);
 
   compressed_frames.Increment();
 }
 
 }  // namespace net