From 9b42785db2d8883ec9f299bd78ba0821c35ac127 Mon Sep 17 00:00:00 2001
From: Vignesh Babu <vigneshbabu@google.com>
Date: Thu, 3 Feb 2022 09:41:39 -0800
Subject: [PATCH] Removing Te metadata key-value pairs sent through initial or
 trailing metadata (#28774)

* Removing invalid Te metadata sent through initial or final metadata

* tidying up code to unlaterally remove Te metadata
---
 src/core/lib/surface/call.cc                  |  4 ++
 .../testcase-5550279127072768                 | 48 +++++++++++++++++++
 2 files changed, 52 insertions(+)
 create mode 100644 test/core/end2end/fuzzers/api_fuzzer_corpus/testcase-5550279127072768

diff --git a/src/core/lib/surface/call.cc b/src/core/lib/surface/call.cc
index 89d5652008b..3a9908bf536 100644
--- a/src/core/lib/surface/call.cc
+++ b/src/core/lib/surface/call.cc
@@ -1441,6 +1441,8 @@ static grpc_call_error call_start_batch(grpc_call* call, const grpc_op* ops,
           error = GRPC_CALL_ERROR_INVALID_METADATA;
           goto done_with_error;
         }
+        // Ignore any te metadata key value pairs specified.
+        call->send_initial_metadata.Remove(grpc_core::TeMetadata());
         /* TODO(ctiller): just make these the same variable? */
         if (call->is_client && call->send_deadline != GRPC_MILLIS_INF_FUTURE) {
           call->send_initial_metadata.Set(grpc_core::GrpcTimeoutMetadata(),
@@ -1568,6 +1570,8 @@ static grpc_call_error call_start_batch(grpc_call* call, const grpc_op* ops,
             grpc_core::GrpcStatusMetadata(),
             op->data.send_status_from_server.status);
 
+        // Ignore any te metadata key value pairs specified.
+        call->send_trailing_metadata.Remove(grpc_core::TeMetadata());
         stream_op_payload->send_trailing_metadata.send_trailing_metadata =
             &call->send_trailing_metadata;
         stream_op_payload->send_trailing_metadata.sent =
diff --git a/test/core/end2end/fuzzers/api_fuzzer_corpus/testcase-5550279127072768 b/test/core/end2end/fuzzers/api_fuzzer_corpus/testcase-5550279127072768
new file mode 100644
index 00000000000..0a3cde58182
--- /dev/null
+++ b/test/core/end2end/fuzzers/api_fuzzer_corpus/testcase-5550279127072768
@@ -0,0 +1,48 @@
+actions {
+  create_server {
+  }
+}
+actions {
+  create_channel {
+    target: "unix:"
+    channel_args {
+      key: "grpgrpc.max_r+ceivc.max_r+ceiv"
+      str: "http"
+    }
+    channel_actions {
+      add_n_bytes_writable: 34359738368
+      add_n_bytes_readable: 34359738368
+    }
+  }
+}
+actions {
+  create_call {
+    propagation_mask: 2621440
+    method {
+      value: "htth"
+    }
+    host {
+      value: "http"
+      intern: true
+    }
+    timeout: 1935985152
+  }
+}
+actions {
+  queue_batch {
+    operations {
+      send_initial_metadata {
+        metadata {
+          key {
+            value: "te"
+          }
+          value {
+            value: "invalid-value"
+            intern: true
+          }
+        }
+      }
+    }
+  }
+}
+