roll: pw_toolchain, pw_toolchain: pw_grpc: Avoid buffer overflow when processing corrupt frames HTTP2 HEADERS and DATA frames are variable-length frames, that include flags that enable certain features that take up space in the frame: e.g. a "padding" bit that adds a 1-byte "padding" field, or a "priority" flag that adds a 5-byte "priority" field. The handlers for these frames did not verify the size of the frame payloads when reading these optional fields, if present. Thus, an undersized frame that had these flag bits set would lead to a buffer overread. This commit improves the handlers to explicitly check the frame sizes, and send the appropriate connection errors (according to the RFC) if they occur, without reading past the end of the payload buffer. If this occurs, it's almost certainly due to some underlying transport corruption. Original-Reviewed-on: https://pigweed-review.googlesource.com/c/pigweed/pigweed/+/216651 Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com> https://pigweed.googlesource.com/pigweed/pigweed pw_toolchain, pw_toolchain Rolled-Commits: 9650f5fcbae1ea3..49d5876907ba804 Roller-URL: https://ci.chromium.org/b/8744757712942869777 GitWatcher: ignore CQ-Do-Not-Cancel-Tryjobs: true Change-Id: I2a74e69fbffecdca4ba419706f89395dc6bd1a40 Reviewed-on: https://pigweed-review.googlesource.com/c/pigweed/quickstart/bazel/+/216816 Commit-Queue: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com> Lint: Lint 🤖 <android-build-ayeaye@system.gserviceaccount.com> Bot-Commit: Pigweed Roller <pigweed-roller@pigweed-service-accounts.iam.gserviceaccount.com>
diff --git a/WORKSPACE b/WORKSPACE index 9fec937..759e705 100644 --- a/WORKSPACE +++ b/WORKSPACE
@@ -84,8 +84,8 @@ name = "pigweed", # ROLL: Warning: this entry is automatically updated. # ROLL: Last updated 2024-06-18. - # ROLL: By https://cr-buildbucket.appspot.com/build/8744758101683798225. - commit = "9650f5fcbae1ea3e37bc34794be3059e69b62031", + # ROLL: By https://cr-buildbucket.appspot.com/build/8744757712942869777. + commit = "49d5876907ba804db2e49e24d35682c85cca2798", remote = "https://pigweed.googlesource.com/pigweed/pigweed.git", ) @@ -93,8 +93,8 @@ name = "pw_toolchain", # ROLL: Warning: this entry is automatically updated. # ROLL: Last updated 2024-06-18. - # ROLL: By https://cr-buildbucket.appspot.com/build/8744758101683798225. - commit = "9650f5fcbae1ea3e37bc34794be3059e69b62031", + # ROLL: By https://cr-buildbucket.appspot.com/build/8744757712942869777. + commit = "49d5876907ba804db2e49e24d35682c85cca2798", remote = "https://pigweed.googlesource.com/pigweed/pigweed.git", strip_prefix = "pw_toolchain_bazel", )