Fix a crash when a line with an HTTP chunk length is too long

net/http/http_chunked_decoder_unittest.cc

Index: net/http/http_chunked_decoder_unittest.cc
===================================================================
--- net/http/http_chunked_decoder_unittest.cc	(revision 161387)
+++ net/http/http_chunked_decoder_unittest.cc	(working copy)
@@ -2,11 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "net/http/http_chunked_decoder.h"
+
 #include "base/basictypes.h"
+#include "base/memory/scoped_ptr.h"
 #include "net/base/net_errors.h"
-#include "net/http/http_chunked_decoder.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
+namespace net {
+
 namespace {
 
 typedef testing::Test HttpChunkedDecoderTest;
@@ -15,7 +19,7 @@
              const char* expected_output,
              bool expected_eof,
              int bytes_after_eof) {
-  net::HttpChunkedDecoder decoder;
+  HttpChunkedDecoder decoder;
   EXPECT_FALSE(decoder.reached_eof());
 
   std::string result;
@@ -37,28 +41,26 @@
 void RunTestUntilFailure(const char* inputs[],
                          size_t num_inputs,
                          size_t fail_index) {
-  net::HttpChunkedDecoder decoder;
+  HttpChunkedDecoder decoder;
   EXPECT_FALSE(decoder.reached_eof());
 
   for (size_t i = 0; i < num_inputs; ++i) {
     std::string input = inputs[i];
     int n = decoder.FilterBuf(&input[0], static_cast<int>(input.size()));
     if (n < 0) {
-      EXPECT_EQ(net::ERR_INVALID_CHUNKED_ENCODING, n);
+      EXPECT_EQ(ERR_INVALID_CHUNKED_ENCODING, n);
       EXPECT_EQ(fail_index, i);
       return;
     }
   }
-  FAIL(); // We should have failed on the i'th iteration of the loop.
+  FAIL();  // We should have failed on the |fail_index| iteration of the loop.
 }
 
-}  // namespace
-
 TEST(HttpChunkedDecoderTest, Basic) {
   const char* inputs[] = {
-    "5\r\nhello\r\n0\r\n\r\n"
+    "B\r\nhello hello\r\n0\r\n\r\n"

[mmenke, 2012/10/16 16:19:34]

We didn't have any test in this file validating that the line length was decoded
as a base 16 string, rather than base 10.

   };
-  RunTest(inputs, arraysize(inputs), "hello", true, 0);
+  RunTest(inputs, arraysize(inputs), "hello hello", true, 0);
 }
 
 TEST(HttpChunkedDecoderTest, OneChunk) {
@@ -95,6 +97,20 @@
   RunTest(inputs, arraysize(inputs), "hello", true, 0);
 }
 
+// Same as above, but group carriage returns with previous input.
+TEST(HttpChunkedDecoderTest, Incremental2) {
+  const char* inputs[] = {
+    "5\r",
+    "\n",
+    "hello\r",
+    "\n",
+    "0\r",
+    "\n\r",
+    "\n"
+  };
+  RunTest(inputs, arraysize(inputs), "hello", true, 0);
+}
+
 TEST(HttpChunkedDecoderTest, LF_InsteadOf_CRLF) {
   // Compatibility: [RFC 2616 - Invalid]
   // {Firefox3} - Valid
@@ -307,3 +323,34 @@
   };
   RunTest(inputs, arraysize(inputs), "hello", true, 11);
 }
+
+// Test when the line with the chunk length is too long.
+TEST(HttpChunkedDecoderTest, LongChunkLengthLine) {
+  int big_chunk_length = HttpChunkedDecoder::kMaxLineBufLen;
+  scoped_array<char> big_chunk(new char[big_chunk_length + 1]);
+  memset(big_chunk.get(), '0', big_chunk_length);
+  big_chunk[big_chunk_length] = 0;
+  const char* inputs[] = {
+    big_chunk.get(),
+    "5"
+  };
+  RunTestUntilFailure(inputs, arraysize(inputs), 1);
+}
+
+// Test when the extension portion of the line with the chunk length is too
+// long.
+TEST(HttpChunkedDecoderTest, LongLengthLengthLine) {
+  int big_chunk_length = HttpChunkedDecoder::kMaxLineBufLen;
+  scoped_array<char> big_chunk(new char[big_chunk_length + 1]);
+  memset(big_chunk.get(), '0', big_chunk_length);
+  big_chunk[big_chunk_length] = 0;
+  const char* inputs[] = {
+    "5;",
+    big_chunk.get()
+  };
+  RunTestUntilFailure(inputs, arraysize(inputs), 1);
+}
+
+}  // namespace
+
+}  // namespace net