Expand corpus, fix crash

src/core/ext/transport/chttp2/transport/hpack_parser.c

@@ -638,6 +638,10 @@ static int on_hdr(grpc_chttp2_hpack_parser *p, grpc_mdelem *md,
       return 0;
     }
   }
+  if (p->on_header == NULL) {
+    grpc_mdelem_unref(md);
+    return 0;
+  }
   p->on_header(p->on_header_user_data, md);
   return 1;
 }
@@ -1382,12 +1386,8 @@ static int parse_value_string_with_literal_key(grpc_chttp2_hpack_parser *p,
 
 /* PUBLIC INTERFACE */
 
-static void on_header_not_set(void *user_data, grpc_mdelem *md) {
-  GPR_UNREACHABLE_CODE(return );
-}
-
 void grpc_chttp2_hpack_parser_init(grpc_chttp2_hpack_parser *p) {
-  p->on_header = on_header_not_set;
+  p->on_header = NULL;
   p->on_header_user_data = NULL;
   p->state = parse_begin;
   p->key.str = NULL;
@@ -1455,7 +1455,7 @@ grpc_chttp2_parse_error grpc_chttp2_header_parser_parse(
         stream_parsing->received_close = 1;
       }
     }
-    parser->on_header = on_header_not_set;
+    parser->on_header = NULL;
     parser->on_header_user_data = NULL;
     parser->is_boundary = 0xde;
     parser->is_eof = 0xde;

test/core/end2end/fuzzers/client_fuzzer_corpus/1ca51ab2fefef4f549c4a8e7f4910c6b5a4b4b1d

@@ -0,0 +1 @@
+!m<EFBFBD>
<EFBFBD>!<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>