Merge branch 'fuzzing-wonderful' into rollfwd

src/core/lib/surface/call.c

@@ -989,12 +989,15 @@ static grpc_error *consolidate_batch_errors(batch_control *bctl) {
   if (n == 0) {
     return GRPC_ERROR_NONE;
   } else if (n == 1) {
-    return bctl->errors[0];
+    grpc_error *e = bctl->errors[0];
+    bctl->errors[0] = NULL;
+    return e;
   } else {
     grpc_error *error =
         GRPC_ERROR_CREATE_REFERENCING("Call batch failed", bctl->errors, n);
     for (size_t i = 0; i < n; i++) {
       GRPC_ERROR_UNREF(bctl->errors[i]);
+      bctl->errors[i] = NULL;
     }
     return error;
   }
@@ -1221,8 +1224,8 @@ static void validate_filtered_metadata(grpc_exec_ctx *exec_ctx,
 static void add_batch_error(grpc_exec_ctx *exec_ctx, batch_control *bctl,
                             grpc_error *error) {
   if (error == GRPC_ERROR_NONE) return;
-  cancel_with_error(exec_ctx, bctl->call, GRPC_ERROR_REF(error));
   int idx = (int)gpr_atm_no_barrier_fetch_add(&bctl->num_errors, 1);
+  if (idx > 0) cancel_with_error(exec_ctx, bctl->call, GRPC_ERROR_REF(error));
   bctl->errors[idx] = error;
 }
 
@@ -1258,7 +1261,7 @@ static void receiving_initial_metadata_ready(grpc_exec_ctx *exec_ctx,
         receiving_stream_ready, call->saved_receiving_stream_ready_bctlp,
         grpc_schedule_on_exec_ctx);
     call->saved_receiving_stream_ready_bctlp = NULL;
-    grpc_closure_sched(exec_ctx, saved_rsr_closure, error);
+    grpc_closure_sched(exec_ctx, saved_rsr_closure, GRPC_ERROR_REF(error));
   }
 
   gpr_mu_unlock(&call->mu);

src/core/lib/transport/static_metadata.c

@@ -474,7 +474,7 @@ grpc_mdelem grpc_static_mdelem_for_static_strings(int a, int b) {
   if (a == -1 || b == -1) return GRPC_MDNULL;
   uint32_t k = (uint32_t)(a * 98 + b);
   uint32_t h = elems_phash(k);
-  return elem_keys[h] == k
+  return h < GPR_ARRAY_SIZE(elem_keys) && elem_keys[h] == k
              ? GRPC_MAKE_MDELEM(&grpc_static_mdelem_table[elem_idxs[h]],
                                 GRPC_MDELEM_STORAGE_STATIC)
              : GRPC_MDNULL;

test/core/end2end/fuzzers/api_fuzzer.c

@@ -611,6 +611,7 @@ static call_state *maybe_delete_call_state(call_state *call) {
     grpc_slice_unref(call->slices_to_unref[i]);
   }
   gpr_free(call->to_free);
+  gpr_free(call->slices_to_unref);
 
   gpr_free(call);
 
@@ -633,8 +634,8 @@ static grpc_slice *add_to_slice_unref(call_state *call, grpc_slice s) {
         gpr_realloc(call->slices_to_unref,
                     sizeof(*call->slices_to_unref) * call->cap_slices_to_unref);
   }
-  call->slices_to_unref[call->num_to_free++] = s;
+  call->slices_to_unref[call->num_slices_to_unref++] = s;
-  return &call->slices_to_unref[call->num_to_free - 1];
+  return &call->slices_to_unref[call->num_slices_to_unref - 1];
 }
 
 static void read_metadata(input_stream *inp, size_t *count,

test/core/transport/chttp2/hpack_parser_corpus/051268ade45dbed0aab896d7d9f4d10ba89d3b09

@@ -0,0 +1 @@
+*¤¤¤ğ¤-bin‹c[)(ğ¤-bin-'bin	!!?¤Ûğ!ğ{(-binğ	!\	!å7é;?Gí([(!!\ğ*¤¤Ûğ

test/core/transport/chttp2/hpack_parser_corpus/fcc06696e641a7743bfd2f3b7ecd88e7b727e00a

@@ -0,0 +1 @@
+;?'cđ[(!	đ[N!\	!ĺGý!acceptý.:¤cA)(!)í!ĽŞ)ĺgÝI)(Ů;)Š

tools/codegen/core/gen_static_metadata.py

@@ -461,7 +461,7 @@ print >>C, 'grpc_mdelem grpc_static_mdelem_for_static_strings(int a, int b) {'
 print >>C, '  if (a == -1 || b == -1) return GRPC_MDNULL;'
 print >>C, '  uint32_t k = (uint32_t)(a * %d + b);' % len(all_strs)
 print >>C, '  uint32_t h = elems_phash(k);'
-print >>C, '  return elem_keys[h] == k ? GRPC_MAKE_MDELEM(&grpc_static_mdelem_table[elem_idxs[h]], GRPC_MDELEM_STORAGE_STATIC) : GRPC_MDNULL;'
+print >>C, '  return h < GPR_ARRAY_SIZE(elem_keys) && elem_keys[h] == k ? GRPC_MAKE_MDELEM(&grpc_static_mdelem_table[elem_idxs[h]], GRPC_MDELEM_STORAGE_STATIC) : GRPC_MDNULL;'
 print >>C, '}'
 print >>C