Fix a crash when a line with an HTTP chunk length is too long

net/http/http_chunked_decoder_unittest.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "net/http/http_chunked_decoder.h"
+
 #include "base/basictypes.h"
+#include "base/memory/scoped_ptr.h"
 #include "net/base/net_errors.h"
-#include "net/http/http_chunked_decoder.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
+namespace net {
+
 namespace {
 
 typedef testing::Test HttpChunkedDecoderTest;
 
 void RunTest(const char* inputs[], size_t num_inputs,
              const char* expected_output,
              bool expected_eof,
              int bytes_after_eof) {
-  net::HttpChunkedDecoder decoder;
+  HttpChunkedDecoder decoder;
   EXPECT_FALSE(decoder.reached_eof());
 
   std::string result;
 
   for (size_t i = 0; i < num_inputs; ++i) {
     std::string input = inputs[i];
     int n = decoder.FilterBuf(&input[0], static_cast<int>(input.size()));
     EXPECT_GE(n, 0);
     if (n > 0)
       result.append(input.data(), n);
   }
 
   EXPECT_EQ(expected_output, result);
   EXPECT_EQ(expected_eof, decoder.reached_eof());
   EXPECT_EQ(bytes_after_eof, decoder.bytes_after_eof());
 }
 
 // Feed the inputs to the decoder, until it returns an error.
 void RunTestUntilFailure(const char* inputs[],
                          size_t num_inputs,
                          size_t fail_index) {
-  net::HttpChunkedDecoder decoder;
+  HttpChunkedDecoder decoder;
   EXPECT_FALSE(decoder.reached_eof());
 
   for (size_t i = 0; i < num_inputs; ++i) {
     std::string input = inputs[i];
     int n = decoder.FilterBuf(&input[0], static_cast<int>(input.size()));
     if (n < 0) {
-      EXPECT_EQ(net::ERR_INVALID_CHUNKED_ENCODING, n);
+      EXPECT_EQ(ERR_INVALID_CHUNKED_ENCODING, n);
       EXPECT_EQ(fail_index, i);
       return;
     }
   }
-  FAIL(); // We should have failed on the i'th iteration of the loop.
+  FAIL();  // We should have failed on the |fail_index| iteration of the loop.
 }
 
-}  // namespace
-
 TEST(HttpChunkedDecoderTest, Basic) {
   const char* inputs[] = {
-    "5\r\nhello\r\n0\r\n\r\n"
+    "B\r\nhello hello\r\n0\r\n\r\n"

[mmenke, 2012/10/16 16:19:34]

We didn't have any test in this file validating that the line length was decoded
as a base 16 string, rather than base 10.

   };
-  RunTest(inputs, arraysize(inputs), "hello", true, 0);
+  RunTest(inputs, arraysize(inputs), "hello hello", true, 0);
 }
 
 TEST(HttpChunkedDecoderTest, OneChunk) {
   const char* inputs[] = {
     "5\r\nhello\r\n"
   };
   RunTest(inputs, arraysize(inputs), "hello", false, 0);
 }
 
 TEST(HttpChunkedDecoderTest, Typical) {
@@ skipping 16 matching lines @@
     "\n",
     "0",
     "\r",
     "\n",
     "\r",
     "\n"
   };
   RunTest(inputs, arraysize(inputs), "hello", true, 0);
 }
 
+// Same as above, but group carriage returns with previous input.
+TEST(HttpChunkedDecoderTest, Incremental2) {
+  const char* inputs[] = {
+    "5\r",
+    "\n",
+    "hello\r",
+    "\n",
+    "0\r",
+    "\n\r",
+    "\n"
+  };
+  RunTest(inputs, arraysize(inputs), "hello", true, 0);
+}
+
 TEST(HttpChunkedDecoderTest, LF_InsteadOf_CRLF) {
   // Compatibility: [RFC 2616 - Invalid]
   // {Firefox3} - Valid
   // {IE7, Safari3.1, Opera9.51} - Invalid
   const char* inputs[] = {
     "5\nhello\n",
     "1\n \n",
     "5\nworld\n",
     "0\n\n"
   };
@@ skipping 192 matching lines @@
   RunTest(inputs, arraysize(inputs), "hello", true, 11);
 }
 
 TEST(HttpChunkedDecoderTest, MultipleExtraDataBlocks) {
   const char* inputs[] = {
     "5\r\nhello\r\n0\r\n\r\nextra",
     " bytes"
   };
   RunTest(inputs, arraysize(inputs), "hello", true, 11);
 }
+
+// Test when the line with the chunk length is too long.
+TEST(HttpChunkedDecoderTest, LongChunkLengthLine) {
+  int big_chunk_length = HttpChunkedDecoder::kMaxLineBufLen;
+  scoped_array<char> big_chunk(new char[big_chunk_length + 1]);
+  memset(big_chunk.get(), '0', big_chunk_length);
+  big_chunk[big_chunk_length] = 0;
+  const char* inputs[] = {
+    big_chunk.get(),
+    "5"
+  };
+  RunTestUntilFailure(inputs, arraysize(inputs), 1);
+}
+
+// Test when the extension portion of the line with the chunk length is too
+// long.
+TEST(HttpChunkedDecoderTest, LongLengthLengthLine) {
+  int big_chunk_length = HttpChunkedDecoder::kMaxLineBufLen;
+  scoped_array<char> big_chunk(new char[big_chunk_length + 1]);
+  memset(big_chunk.get(), '0', big_chunk_length);
+  big_chunk[big_chunk_length] = 0;
+  const char* inputs[] = {
+    "5;",
+    big_chunk.get()
+  };
+  RunTestUntilFailure(inputs, arraysize(inputs), 1);
+}
+
+}  // namespace
+
+}  // namespace net