Update from chromium https://crrev.com/301315

net/spdy/spdy_framer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_framer.h"
 
 #include "base/lazy_instance.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/stats_counters.h"
 #include "base/third_party/valgrind/memcheck.h"
@@ skipping 59 matching lines @@
 const size_t kPriorityDependencyPayloadSize = 4;
 const size_t kPriorityWeightPayloadSize = 1;
 
 // Wire size of pad length field.
 const size_t kPadLengthFieldSize = 1;
 
 }  // namespace
 
 const SpdyStreamId SpdyFramer::kInvalidStream = static_cast<SpdyStreamId>(-1);
 const size_t SpdyFramer::kHeaderDataChunkMaxSize = 1024;
+// We fragment sent control frames at smaller payload boundaries.
+const size_t SpdyFramer::kMaxControlFrameSize = 1024;
 // The size of the control frame buffer. Must be >= the minimum size of the
 // largest control frame, which is SYN_STREAM. See GetSynStreamMinimumSize() for
 // calculation details.
 const size_t SpdyFramer::kControlFrameBufferSize = 19;
 
 #ifdef DEBUG_SPDY_STATE_CHANGES
 #define CHANGE_STATE(newstate)                                  \
   do {                                                          \
     DVLOG(1) << "Changing state from: "                         \
              << StateToString(state_)                           \
@@ skipping 66 matching lines @@
       visitor_(NULL),
       debug_visitor_(NULL),
       display_protocol_("SPDY"),
       spdy_version_(version),
       syn_frame_processed_(false),
       probable_http_response_(false),
       expect_continuation_(0),
       end_stream_when_done_(false) {
   DCHECK_GE(spdy_version_, SPDY_MIN_VERSION);
   DCHECK_LE(spdy_version_, SPDY_MAX_VERSION);
+  DCHECK_LE(kMaxControlFrameSize,
+            SpdyConstants::GetFrameMaximumSize(spdy_version_) +
+                SpdyConstants::GetControlFrameHeaderSize(spdy_version_));
   Reset();
 }
 
 SpdyFramer::~SpdyFramer() {
   if (header_compressor_.get()) {
     deflateEnd(header_compressor_.get());
   }
   if (header_decompressor_.get()) {
     inflateEnd(header_decompressor_.get());
   }
@@ skipping 866 matching lines @@
       // with spdy_protocol.h.
       DLOG(FATAL);
       set_error(SPDY_INVALID_CONTROL_FRAME);
       break;
   }
 
   if (state_ == SPDY_ERROR) {
     return;
   }
 
-  if (current_frame_length_ > GetControlFrameBufferMaxSize()) {
+  if (current_frame_length_ >
+      SpdyConstants::GetFrameMaximumSize(protocol_version()) +
+          SpdyConstants::GetControlFrameHeaderSize(protocol_version())) {
     DLOG(WARNING) << "Received control frame with way too big of a payload: "
                   << current_frame_length_;
     set_error(SPDY_CONTROL_PAYLOAD_TOO_LARGE);
     return;
   }
 
   if (current_frame_type_ == GOAWAY) {
     CHANGE_STATE(SPDY_GOAWAY_FRAME_PAYLOAD);
     return;
   }
@@ skipping 1088 matching lines @@
 }
 
 size_t SpdyFramer::ProcessDataFramePaddingLength(const char* data, size_t len) {
   DCHECK_EQ(SPDY_READ_DATA_FRAME_PADDING_LENGTH, state_);
   DCHECK_EQ(0u, remaining_padding_payload_length_);
   DCHECK_EQ(DATA, current_frame_type_);
 
   size_t original_len = len;
   if (current_frame_flags_ & DATA_FLAG_PADDED) {
     if (len != 0) {
-      if (remaining_data_length_ < 1) {
+      if (remaining_data_length_ < kPadLengthFieldSize) {
         set_error(SPDY_INVALID_DATA_FRAME_FLAGS);
         return 0;
       }
 
       remaining_padding_payload_length_ = *reinterpret_cast<const uint8*>(data);
       ++data;
       --len;
       --remaining_data_length_;
     } else {
       // We don't have the data available for parsing the pad length field. Keep
@@ skipping 480 matching lines @@
   string hpack_encoding;
   if (protocol_version() > SPDY3) {
     if (enable_compression_) {
       GetHpackEncoder()->EncodeHeaderSet(
           headers.name_value_block(), &hpack_encoding);
     } else {
       GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
           headers.name_value_block(), &hpack_encoding);
     }
     size += hpack_encoding.size();
-    if (size > GetHeaderFragmentMaxSize()) {
+    if (size > kMaxControlFrameSize) {
       size += GetNumberRequiredContinuationFrames(size) *
               GetContinuationMinimumSize();
       flags &= ~HEADERS_FLAG_END_HEADERS;
     }
   } else {
     size += GetSerializedLength(headers.name_value_block());
   }
 
   SpdyFrameBuilder builder(size, protocol_version());
   if (protocol_version() <= SPDY3) {
@@ skipping 87 matching lines @@
 
   string hpack_encoding;
   if (enable_compression_) {
     GetHpackEncoder()->EncodeHeaderSet(
         push_promise.name_value_block(), &hpack_encoding);
   } else {
     GetHpackEncoder()->EncodeHeaderSetWithoutCompression(
         push_promise.name_value_block(), &hpack_encoding);
   }
   size += hpack_encoding.size();
-  if (size > GetHeaderFragmentMaxSize()) {
+  if (size > kMaxControlFrameSize) {
     size += GetNumberRequiredContinuationFrames(size) *
             GetContinuationMinimumSize();
     flags &= ~PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
   }
 
   SpdyFrameBuilder builder(size, protocol_version());
   builder.BeginNewFrame(*this,
                         PUSH_PROMISE,
                         flags,
                         push_promise.stream_id());
@@ skipping 177 matching lines @@
   if (!enable_compression_) {
     return uncompressed_length;
   }
   z_stream* compressor = GetHeaderCompressor();
   // Since we'll be performing lots of flushes when compressing the data,
   // zlib's lower bounds may be insufficient.
   return 2 * deflateBound(compressor, uncompressed_length);
 }
 
 size_t SpdyFramer::GetNumberRequiredContinuationFrames(size_t size) {
-  const size_t kMaxControlFrameSize = GetHeaderFragmentMaxSize();
   DCHECK_GT(protocol_version(), SPDY3);
   DCHECK_GT(size, kMaxControlFrameSize);
   size_t overflow = size - kMaxControlFrameSize;
   return overflow / (kMaxControlFrameSize - GetContinuationMinimumSize()) + 1;
 }
 
 void SpdyFramer::WritePayloadWithContinuation(SpdyFrameBuilder* builder,
                                               const string& hpack_encoding,
                                               SpdyStreamId stream_id,
                                               SpdyFrameType type,
                                               int padding_payload_len) {
-  const size_t kMaxControlFrameSize = GetHeaderFragmentMaxSize();
-
     uint8 end_flag = 0;
     uint8 flags = 0;
     if (type == HEADERS) {
       end_flag = HEADERS_FLAG_END_HEADERS;
     } else if (type == PUSH_PROMISE) {
       end_flag = PUSH_PROMISE_FLAG_END_PUSH_PROMISE;
     } else {
       DLOG(FATAL) << "CONTINUATION frames cannot be used with frame type "
                   << FrameTypeToString(type);
     }
@@ skipping 302 matching lines @@
   builder->Seek(compressed_size);
   builder->RewriteLength(*this);
 
   pre_compress_bytes.Add(uncompressed_len);
   post_compress_bytes.Add(compressed_size);
 
   compressed_frames.Increment();
 }
 
 }  // namespace net