diff --git a/src/core/ext/transport/chttp2/transport/chttp2_transport.cc b/src/core/ext/transport/chttp2/transport/chttp2_transport.cc index 27e3342ecb2..93abc3a8fee 100644 --- a/src/core/ext/transport/chttp2/transport/chttp2_transport.cc +++ b/src/core/ext/transport/chttp2/transport/chttp2_transport.cc @@ -445,7 +445,7 @@ static void read_channel_args(grpc_chttp2_transport* t, // `GRPC_ARG_ABSOLUTE_MAX_METADATA_SIZE` is not set. const int soft_limit = channel_args.GetInt(GRPC_ARG_MAX_METADATA_SIZE) .value_or(setting.default_value); - const int value = (soft_limit < (INT_MAX / 1.25)) + const int value = (soft_limit >= 0 && soft_limit < (INT_MAX / 1.25)) ? static_cast(soft_limit * 1.25) : soft_limit; if (value > DEFAULT_MAX_HEADER_LIST_SIZE) { diff --git a/test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-minimized-api_fuzzer-4813636509761536 b/test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-minimized-api_fuzzer-4813636509761536 new file mode 100644 index 00000000000..b44c1cc0244 --- /dev/null +++ b/test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-minimized-api_fuzzer-4813636509761536 @@ -0,0 +1,21 @@ +actions { + create_channel { + target: "unix: {" + channel_args { + key: "grpc.max_metadata_size" + i: 1236454714901355 + } + channel_actions { + add_n_bytes_writable: 21 + add_n_bytes_readable: 18446744069414584320 + wait_ms: 8 + } + } +} +actions { + create_server { + } +} +actions { + check_connectivity: true +}