Index: net/quic/quic_spdy_server_stream.cc |
diff --git a/net/quic/quic_spdy_server_stream.cc b/net/quic/quic_spdy_server_stream.cc |
index bc67bb96662836ea1e8b1800fcdfadb6f6728ef4..c5b582b5faaee2e31856d0e79b5400463bdb105b 100644 |
--- a/net/quic/quic_spdy_server_stream.cc |
+++ b/net/quic/quic_spdy_server_stream.cc |
@@ -32,6 +32,10 @@ QuicSpdyServerStream::~QuicSpdyServerStream() { |
} |
uint32 QuicSpdyServerStream::ProcessData(const char* data, uint32 data_len) { |
+ if (data_len > INT_MAX) { |
+ LOG(DFATAL) << "Data length too long: " << data_len; |
+ return 0; |
+ } |
// Are we still reading the request headers. |
if (!request_headers_received_) { |
// Grow the read buffer if necessary. |
@@ -77,12 +81,12 @@ void QuicSpdyServerStream::OnFinRead() { |
// there's more data. |
void QuicSpdyServerStream::ParseRequestHeaders() { |
SpdyFramer framer((kDefaultSpdyMajorVersion)); |
- char* data = read_buf_->StartOfBuffer(); |
+ const char* data = read_buf_->StartOfBuffer(); |
size_t read_buf_len = static_cast<size_t>(read_buf_->offset()); |
size_t len = framer.ParseHeaderBlockInBuffer(data, read_buf_len, &headers_); |
if (len == 0) { |
// Not enough data yet, presumably. (If we still don't succeed by the end of |
- // the stream, then we'll error above.) |
+ // the stream, then we'll error in OnFinRead().) |
return; |
} |
@@ -125,7 +129,7 @@ void QuicSpdyServerStream::SendResponse() { |
} |
DVLOG(1) << "Sending response for stream " << id(); |
- SendHeadersAndBody(response->headers(), response->body()); |
+ SendHeadersAndBody(*response->headers(), response->body()); |
} |
void QuicSpdyServerStream::SendErrorResponse() { |