From 2ee8cb998bf3fb607a74bdf69fdc873a4f6aa582 Mon Sep 17 00:00:00 2001
From: Noah Eisen <ncteisen@google.com>
Date: Tue, 13 Feb 2018 16:29:40 -0800
Subject: [PATCH 1/2] Add fuzz repro

---
 ...case-minimized-api_fuzzer-5632636438446080 | Bin 0 -> 57 bytes
 tools/run_tests/generated/tests.json          |  23 ++++++++++++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-minimized-api_fuzzer-5632636438446080

diff --git a/test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-minimized-api_fuzzer-5632636438446080 b/test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-minimized-api_fuzzer-5632636438446080
new file mode 100644
index 0000000000000000000000000000000000000000..4f995ac8e136bcacbc82d88454fc21da2808b84d
GIT binary patch
literal 57
zcmWe*00R~VW~SoQqO#N?Mn<OeqJm_-jFOUq_~iV&ywv29c&L;D2P5PE{|X?i004?S
B5gY&j

literal 0
HcmV?d00001

diff --git a/tools/run_tests/generated/tests.json b/tools/run_tests/generated/tests.json
index 44b5a81bdc7..dbbbc535abb 100644
--- a/tools/run_tests/generated/tests.json
+++ b/tools/run_tests/generated/tests.json
@@ -93261,6 +93261,29 @@
     ], 
     "uses_polling": false
   }, 
+  {
+    "args": [
+      "test/core/end2end/fuzzers/api_fuzzer_corpus/clusterfuzz-testcase-minimized-api_fuzzer-5632636438446080"
+    ], 
+    "ci_platforms": [
+      "linux"
+    ], 
+    "cpu_cost": 0.1, 
+    "exclude_configs": [
+      "tsan"
+    ], 
+    "exclude_iomgrs": [
+      "uv"
+    ], 
+    "flaky": false, 
+    "language": "c", 
+    "name": "api_fuzzer_one_entry", 
+    "platforms": [
+      "mac", 
+      "linux"
+    ], 
+    "uses_polling": false
+  }, 
   {
     "args": [
       "test/core/end2end/fuzzers/api_fuzzer_corpus/crash-0597bbdd657fa4ed14443994c9147a1a7bbc205f"

From 49cab8f4c6e7642a376eb1ec835a4790a53d19a3 Mon Sep 17 00:00:00 2001
From: Noah Eisen <ncteisen@google.com>
Date: Wed, 14 Feb 2018 07:36:33 -0800
Subject: [PATCH 2/2] Fix handshaker crash

---
 src/core/ext/filters/client_channel/http_connect_handshaker.cc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/core/ext/filters/client_channel/http_connect_handshaker.cc b/src/core/ext/filters/client_channel/http_connect_handshaker.cc
index 6bb4cefe73c..88bcc03a3c9 100644
--- a/src/core/ext/filters/client_channel/http_connect_handshaker.cc
+++ b/src/core/ext/filters/client_channel/http_connect_handshaker.cc
@@ -254,7 +254,8 @@ static void http_connect_handshaker_do_handshake(
   // If not found, invoke on_handshake_done without doing anything.
   const grpc_arg* arg =
       grpc_channel_args_find(args->args, GRPC_ARG_HTTP_CONNECT_SERVER);
-  if (arg == nullptr) {
+  if (arg == nullptr || arg->type != GRPC_ARG_STRING) {
+    gpr_log(GPR_INFO, "HTTP CONNECT channel arg not found or invalid");
     // Set shutdown to true so that subsequent calls to
     // http_connect_handshaker_shutdown() do nothing.
     gpr_mu_lock(&handshaker->mu);