Skip to content

Commit 575d56b

Browse files
committed
Fix assertion while filling H2 decoded ring buffer
Thanks to OSS-Fuzz: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69232
1 parent e1442a5 commit 575d56b

File tree

1 file changed

+13
-8
lines changed

1 file changed

+13
-8
lines changed

src/lib/lwan-h2-huffman.c

+13-8
Original file line numberDiff line numberDiff line change
@@ -331,12 +331,11 @@ ssize_t lwan_h2_huffman_next(struct lwan_h2_huffman_decoder *huff)
331331
struct uint8_ring_buffer *buffer = &huff->buffer;
332332

333333
while (reader->total_bitcount > 7) {
334-
if (uint8_ring_buffer_full(buffer))
335-
goto done;
336-
337334
uint8_t peeked_byte = peek_byte(reader);
338335
if (LIKELY(level0[peeked_byte].num_bits)) {
339-
uint8_ring_buffer_put_copy(buffer, level0[peeked_byte].symbol);
336+
if (!uint8_ring_buffer_try_put_copy(buffer,
337+
level0[peeked_byte].symbol))
338+
goto done;
340339
consume(reader, level0[peeked_byte].num_bits);
341340
assert(reader->total_bitcount >= 0);
342341
continue;
@@ -348,7 +347,9 @@ ssize_t lwan_h2_huffman_next(struct lwan_h2_huffman_decoder *huff)
348347
const struct h2_huffman_code *level1 = next_level0(peeked_byte);
349348
peeked_byte = peek_byte(reader);
350349
if (level1[peeked_byte].num_bits) {
351-
uint8_ring_buffer_put_copy(buffer, level1[peeked_byte].symbol);
350+
if (!uint8_ring_buffer_try_put_copy(buffer,
351+
level1[peeked_byte].symbol))
352+
goto done;
352353
if (!consume(reader, level1[peeked_byte].num_bits))
353354
return -1;
354355
continue;
@@ -360,7 +361,9 @@ ssize_t lwan_h2_huffman_next(struct lwan_h2_huffman_decoder *huff)
360361
const struct h2_huffman_code *level2 = next_level1(peeked_byte);
361362
peeked_byte = peek_byte(reader);
362363
if (level2[peeked_byte].num_bits) {
363-
uint8_ring_buffer_put_copy(buffer, level2[peeked_byte].symbol);
364+
if (!uint8_ring_buffer_try_put_copy(buffer,
365+
level2[peeked_byte].symbol))
366+
goto done;
364367
if (!consume(reader, level2[peeked_byte].num_bits))
365368
return -1;
366369
continue;
@@ -377,7 +380,9 @@ ssize_t lwan_h2_huffman_next(struct lwan_h2_huffman_decoder *huff)
377380
goto done;
378381
}
379382
if (LIKELY(level3[peeked_byte].num_bits)) {
380-
uint8_ring_buffer_put_copy(buffer, level3[peeked_byte].symbol);
383+
if (!uint8_ring_buffer_try_put_copy(buffer,
384+
level3[peeked_byte].symbol))
385+
goto done;
381386
if (!consume(reader, level3[peeked_byte].num_bits))
382387
return -1;
383388
continue;
@@ -398,7 +403,7 @@ ssize_t lwan_h2_huffman_next(struct lwan_h2_huffman_decoder *huff)
398403
goto done;
399404

400405
if (level0[peeked_byte].num_bits == (int8_t)reader->total_bitcount) {
401-
uint8_ring_buffer_put_copy(buffer, level0[peeked_byte].symbol);
406+
uint8_ring_buffer_try_put_copy(buffer, level0[peeked_byte].symbol);
402407
goto done;
403408
}
404409

0 commit comments

Comments
 (0)