mirror of https://github.com/grpc/grpc.git
grpc_chttp2_maybe_complete_recv_trailing_metadata() moves at least GRPC_HEADER_SIZE_IN_BYTES from the frame storage, whenever the frame storage is non-empty. Instead ensure that we have at least GRPC_HEADER_SIZE_IN_BYTES in the frame storage. This results in bugs detected by clusterfuzz in chrome: https://bugs.chromium.org/p/chromium/issues/detail?id=984534 https://bugs.chromium.org/p/chromium/issues/detail?id=984478#c2pull/19657/head
parent
d56e4eb0fd
commit
b58d2e84ab
1 changed files with 4 additions and 3 deletions
Loading…
Reference in new issue