| Index: net/quic/quic_spdy_server_stream.cc
|
| diff --git a/net/quic/quic_spdy_server_stream.cc b/net/quic/quic_spdy_server_stream.cc
|
| index baadf5eeb91f53fdf3b98323b2a5fcddfde78f58..6038ccb1ddff0b550b88d1cde22ea8f7d9cc325e 100644
|
| --- a/net/quic/quic_spdy_server_stream.cc
|
| +++ b/net/quic/quic_spdy_server_stream.cc
|
| @@ -32,10 +32,14 @@ QuicSpdyServerStream::~QuicSpdyServerStream() {
|
| }
|
|
|
| uint32 QuicSpdyServerStream::ProcessData(const char* data, uint32 data_len) {
|
| + if (data_len > INT_MAX) {
|
| + LOG(DFATAL) << "Data length too long: " << data_len;
|
| + return 0;
|
| + }
|
| // Are we still reading the request headers.
|
| if (!request_headers_received_) {
|
| // Grow the read buffer if necessary.
|
| - while (read_buf_->RemainingCapacity() < (int)data_len) {
|
| + while (read_buf_->RemainingCapacity() < static_cast<int>(data_len)) {
|
| read_buf_->SetCapacity(read_buf_->capacity() * 2);
|
| }
|
| memcpy(read_buf_->data(), data, data_len);
|
| @@ -76,13 +80,13 @@ void QuicSpdyServerStream::OnFinRead() {
|
| // request_headers_received_. If not successful, it can just be tried again once
|
| // there's more data.
|
| void QuicSpdyServerStream::ParseRequestHeaders() {
|
| - SpdyFramer framer(kDefaultSpdyMajorVersion);
|
| - char* data = read_buf_->StartOfBuffer();
|
| + SpdyFramer framer((kDefaultSpdyMajorVersion));
|
| + const char* data = read_buf_->StartOfBuffer();
|
| size_t read_buf_len = static_cast<size_t>(read_buf_->offset());
|
| size_t len = framer.ParseHeaderBlockInBuffer(data, read_buf_len, &headers_);
|
| if (len == 0) {
|
| // Not enough data yet, presumably. (If we still don't succeed by the end of
|
| - // the stream, then we'll error above.)
|
| + // the stream, then we'll error in OnFinRead().)
|
| return;
|
| }
|
|
|
|
|