| Index: net/quic/quic_spdy_server_stream.cc
|
| diff --git a/net/quic/quic_spdy_server_stream.cc b/net/quic/quic_spdy_server_stream.cc
|
| index bc67bb96662836ea1e8b1800fcdfadb6f6728ef4..c5b582b5faaee2e31856d0e79b5400463bdb105b 100644
|
| --- a/net/quic/quic_spdy_server_stream.cc
|
| +++ b/net/quic/quic_spdy_server_stream.cc
|
| @@ -32,6 +32,10 @@ QuicSpdyServerStream::~QuicSpdyServerStream() {
|
| }
|
|
|
| uint32 QuicSpdyServerStream::ProcessData(const char* data, uint32 data_len) {
|
| + if (data_len > INT_MAX) {
|
| + LOG(DFATAL) << "Data length too long: " << data_len;
|
| + return 0;
|
| + }
|
| // Are we still reading the request headers.
|
| if (!request_headers_received_) {
|
| // Grow the read buffer if necessary.
|
| @@ -77,12 +81,12 @@ void QuicSpdyServerStream::OnFinRead() {
|
| // there's more data.
|
| void QuicSpdyServerStream::ParseRequestHeaders() {
|
| SpdyFramer framer((kDefaultSpdyMajorVersion));
|
| - char* data = read_buf_->StartOfBuffer();
|
| + const char* data = read_buf_->StartOfBuffer();
|
| size_t read_buf_len = static_cast<size_t>(read_buf_->offset());
|
| size_t len = framer.ParseHeaderBlockInBuffer(data, read_buf_len, &headers_);
|
| if (len == 0) {
|
| // Not enough data yet, presumably. (If we still don't succeed by the end of
|
| - // the stream, then we'll error above.)
|
| + // the stream, then we'll error in OnFinRead().)
|
| return;
|
| }
|
|
|
| @@ -125,7 +129,7 @@ void QuicSpdyServerStream::SendResponse() {
|
| }
|
|
|
| DVLOG(1) << "Sending response for stream " << id();
|
| - SendHeadersAndBody(response->headers(), response->body());
|
| + SendHeadersAndBody(*response->headers(), response->body());
|
| }
|
|
|
| void QuicSpdyServerStream::SendErrorResponse() {
|
|
|