Fix failures in fuzzing tests

src/core/ext/transport/chttp2/transport/chttp2_transport.c

@@ -178,6 +178,7 @@ static void destruct_transport(grpc_exec_ctx *exec_ctx,
     t->write_cb_pool = next;
   }
 
+  gpr_free(t->ping_acks);
   gpr_free(t->peer_string);
   gpr_free(t);
 }

src/core/ext/transport/chttp2/transport/frame_ping.c

@@ -103,7 +103,7 @@ grpc_error *grpc_chttp2_ping_parser_parse(grpc_exec_ctx *exec_ctx, void *parser,
     } else {
       if (t->ping_ack_count == t->ping_ack_capacity) {
         t->ping_ack_capacity = GPR_MAX(t->ping_ack_capacity * 3 / 2, 3);
-        t->ping_acks = gpr_realloc(t->ping_acks, t->ping_ack_capacity);
+        t->ping_acks = gpr_realloc(t->ping_acks, t->ping_ack_capacity * sizeof(*t->ping_acks));
       }
       t->ping_acks[t->ping_ack_count++] = p->opaque_8bytes;
       grpc_chttp2_initiate_write(exec_ctx, t, false, "ping response");

src/core/ext/transport/chttp2/transport/parsing.c

@@ -385,12 +385,14 @@ static grpc_error *update_incoming_window(grpc_exec_ctx *exec_ctx,
     grpc_chttp2_initiate_write(exec_ctx, t, false, "flow_control");
   }
 
+  if (s != NULL) {
     if (incoming_frame_size >
         s->incoming_window_delta +
             t->settings[GRPC_ACKED_SETTINGS]
                        [GRPC_CHTTP2_SETTINGS_INITIAL_WINDOW_SIZE]) {
       char *msg;
-    gpr_asprintf(&msg, "frame of size %d overflows incoming window of %" PRId64,
+      gpr_asprintf(&msg,
+                   "frame of size %d overflows incoming window of %" PRId64,
                    t->incoming_frame_size,
                    s->incoming_window_delta +
                        t->settings[GRPC_ACKED_SETTINGS]
@@ -400,7 +402,6 @@ static grpc_error *update_incoming_window(grpc_exec_ctx *exec_ctx,
       return err;
     }
 
-  if (s != NULL) {
     GRPC_CHTTP2_FLOW_DEBIT_STREAM("parse", t, s, incoming_window_delta,
                                   incoming_frame_size);
     if (s->incoming_window_delta - s->announce_window <=