commit 0c3fdad486d2fb23e60e1a3bf261b1846c877148
author Craig Tiller <ctiller@google.com> Sat Jan 21 15:16:26 2017 -0800
committer Craig Tiller <ctiller@google.com> Sat Jan 21 15:16:26 2017 -0800
tree fe5230b0d906d540c66871bee8eeb00fb0084aca
parent f28ca8ea22ec19d490129e49967024110bb3c463

Fix hpack fuzzer

src/core/lib/transport/static_metadata.c

diff --git a/src/core/lib/transport/static_metadata.c b/src/core/lib/transport/static_metadata.c
index 5adc321..750711b 100644
--- a/src/core/lib/transport/static_metadata.c
+++ b/src/core/lib/transport/static_metadata.c
@@ -474,7 +474,7 @@
   if (a == -1 || b == -1) return GRPC_MDNULL;
   uint32_t k = (uint32_t)(a * 98 + b);
   uint32_t h = elems_phash(k);
-  return elem_keys[h] == k
+  return h < GPR_ARRAY_SIZE(elem_keys) && elem_keys[h] == k
              ? GRPC_MAKE_MDELEM(&grpc_static_mdelem_table[elem_idxs[h]],
                                 GRPC_MDELEM_STORAGE_STATIC)
              : GRPC_MDNULL;

tools/codegen/core/gen_static_metadata.py

diff --git a/tools/codegen/core/gen_static_metadata.py b/tools/codegen/core/gen_static_metadata.py
index 0374cf7..4703708 100755
--- a/tools/codegen/core/gen_static_metadata.py
+++ b/tools/codegen/core/gen_static_metadata.py
@@ -461,7 +461,7 @@
 print >>C, '  if (a == -1 || b == -1) return GRPC_MDNULL;'
 print >>C, '  uint32_t k = (uint32_t)(a * %d + b);' % len(all_strs)
 print >>C, '  uint32_t h = elems_phash(k);'
-print >>C, '  return elem_keys[h] == k ? GRPC_MAKE_MDELEM(&grpc_static_mdelem_table[elem_idxs[h]], GRPC_MDELEM_STORAGE_STATIC) : GRPC_MDNULL;'
+print >>C, '  return h < GPR_ARRAY_SIZE(elem_keys) && elem_keys[h] == k ? GRPC_MAKE_MDELEM(&grpc_static_mdelem_table[elem_idxs[h]], GRPC_MDELEM_STORAGE_STATIC) : GRPC_MDNULL;'
 print >>C, '}'
 print >>C