Guard against duplicate ops in the same batch (#28118)

* Guard against duplicate ops in the same batch

* add test

* add fuzzer example

* better name

src/core/lib/surface/call.cc

@@ -1553,6 +1553,14 @@ static grpc_call_error call_start_batch(grpc_call* call, const grpc_op* ops,
   grpc_call_error error = GRPC_CALL_OK;
   grpc_transport_stream_op_batch* stream_op;
   grpc_transport_stream_op_batch_payload* stream_op_payload;
+  uint32_t seen_ops = 0;
+
+  for (i = 0; i < nops; i++) {
+    if (seen_ops & (1u << ops[i].op)) {
+      return GRPC_CALL_ERROR_TOO_MANY_OPERATIONS;
+    }
+    seen_ops |= (1u << ops[i].op);
+  }
 
   GRPC_CALL_LOG_BATCH(GPR_INFO, ops, nops);
 

test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-minimized-api_fuzzer-4849973711994880

@@ -0,0 +1,55 @@
+actions {
+  create_channel {
+    target: "dse:snrver"
+  }
+}
+actions {
+  create_call {
+    method {
+      value: "%:?"
+    }
+  }
+}
+actions {
+  queue_batch {
+    operations {
+      receive_initial_metadata {
+      }
+    }
+    operations {
+      send_message {
+        message {
+          intern: true
+        }
+        message {
+          intern: true
+        }
+        message {
+          intern: true
+        }
+        message {
+          value: "bob"
+        }
+        message {
+          intern: true
+        }
+        message {
+          intern: true
+        }
+        message {
+          intern: true
+        }
+        message {
+          intern: true
+        }
+        message {
+          intern: true
+        }
+      }
+    }
+    operations {
+      receive_initial_metadata {
+      }
+    }
+  }
+}

test/core/end2end/invalid_call_argument_test.cc

@@ -607,6 +607,31 @@ static void test_invalid_initial_metadata_reserved_key() {
   cleanup_test();
 }
 
+static void test_multiple_ops_in_a_single_batch() {
+  gpr_log(GPR_INFO, "test_multiple_ops_in_a_single_batch");
+
+  grpc_op* op;
+  prepare_test(1);
+
+  for (auto which :
+       {GRPC_OP_SEND_INITIAL_METADATA, GRPC_OP_RECV_INITIAL_METADATA,
+        GRPC_OP_SEND_MESSAGE, GRPC_OP_RECV_MESSAGE,
+        GRPC_OP_RECV_STATUS_ON_CLIENT, GRPC_OP_RECV_CLOSE_ON_SERVER,
+        GRPC_OP_SEND_STATUS_FROM_SERVER, GRPC_OP_RECV_CLOSE_ON_SERVER}) {
+    op = g_state.ops;
+    op->op = which;
+    op++;
+    op->op = which;
+    op++;
+    GPR_ASSERT(GRPC_CALL_ERROR_TOO_MANY_OPERATIONS ==
+               grpc_call_start_batch(g_state.call, g_state.ops,
+                                     (size_t)(op - g_state.ops), tag(1),
+                                     nullptr));
+  }
+
+  cleanup_test();
+}
+
 int main(int argc, char** argv) {
   grpc::testing::TestEnvironment env(argc, argv);
   grpc_init();
@@ -630,6 +655,7 @@ int main(int argc, char** argv) {
   test_send_server_status_twice();
   test_recv_close_on_server_with_invalid_flags();
   test_recv_close_on_server_twice();
+  test_multiple_ops_in_a_single_batch();
   grpc_shutdown();
 
   return 0;