Chromium Code Reviews| Index: net/quic/quic_spdy_server_stream.cc |
| diff --git a/net/quic/quic_spdy_server_stream.cc b/net/quic/quic_spdy_server_stream.cc |
| index bc67bb96662836ea1e8b1800fcdfadb6f6728ef4..c5b582b5faaee2e31856d0e79b5400463bdb105b 100644 |
| --- a/net/quic/quic_spdy_server_stream.cc |
| +++ b/net/quic/quic_spdy_server_stream.cc |
| @@ -32,6 +32,10 @@ QuicSpdyServerStream::~QuicSpdyServerStream() { |
| } |
| uint32 QuicSpdyServerStream::ProcessData(const char* data, uint32 data_len) { |
| + if (data_len > INT_MAX) { |
|
Ryan Hamilton
2014/07/02 19:31:31
Is INT_MAX the right type here, since int *might*
wtc
2014/07/02 19:39:08
This protects the cast of 'data_len' to 'int' on l
|
| + LOG(DFATAL) << "Data length too long: " << data_len; |
| + return 0; |
| + } |
| // Are we still reading the request headers. |
| if (!request_headers_received_) { |
| // Grow the read buffer if necessary. |
| @@ -77,12 +81,12 @@ void QuicSpdyServerStream::OnFinRead() { |
| // there's more data. |
| void QuicSpdyServerStream::ParseRequestHeaders() { |
| SpdyFramer framer((kDefaultSpdyMajorVersion)); |
| - char* data = read_buf_->StartOfBuffer(); |
| + const char* data = read_buf_->StartOfBuffer(); |
| size_t read_buf_len = static_cast<size_t>(read_buf_->offset()); |
| size_t len = framer.ParseHeaderBlockInBuffer(data, read_buf_len, &headers_); |
| if (len == 0) { |
| // Not enough data yet, presumably. (If we still don't succeed by the end of |
| - // the stream, then we'll error above.) |
| + // the stream, then we'll error in OnFinRead().) |
| return; |
| } |
| @@ -125,7 +129,7 @@ void QuicSpdyServerStream::SendResponse() { |
| } |
| DVLOG(1) << "Sending response for stream " << id(); |
| - SendHeadersAndBody(response->headers(), response->body()); |
| + SendHeadersAndBody(*response->headers(), response->body()); |
|
wtc
2014/07/02 19:39:08
Hmm... If we are still dereferencing response->hea
dmz
2014/07/02 20:58:39
Alright, I've undone the change.
|
| } |
| void QuicSpdyServerStream::SendErrorResponse() { |