bug 780104 - fail gracefully on invalid spdy dictionary r=honzab

netwerk/protocol/http/SpdySession2.cpp

@@ -569,6 +569,7 @@ SpdySession2::DownstreamUncompress(char *blockStart, PRUint32 blockLen)
 
   mDownstreamZlib.avail_in = blockLen;
   mDownstreamZlib.next_in = reinterpret_cast<unsigned char *>(blockStart);
+  bool triedDictionary = false;
 
   do {
     mDownstreamZlib.next_out =
@@ -577,11 +578,18 @@ SpdySession2::DownstreamUncompress(char *blockStart, PRUint32 blockLen)
     mDownstreamZlib.avail_out = mDecompressBufferSize - mDecompressBufferUsed;
     int zlib_rv = inflate(&mDownstreamZlib, Z_NO_FLUSH);
 
-    if (zlib_rv == Z_NEED_DICT)
+    if (zlib_rv == Z_NEED_DICT) {
+      if (triedDictionary) {
+        LOG3(("SpdySession2::DownstreamUncompress %p Dictionary Error\n", this));
+        return NS_ERROR_FAILURE;
+      }
+      
+      triedDictionary = true;
       inflateSetDictionary(&mDownstreamZlib,
                            reinterpret_cast<const unsigned char *>
                            (SpdyStream2::kDictionary),
                            strlen(SpdyStream2::kDictionary) + 1);
+    }
     
     if (zlib_rv == Z_DATA_ERROR || zlib_rv == Z_MEM_ERROR)
       return NS_ERROR_FAILURE;

netwerk/protocol/http/SpdySession3.cpp

@@ -571,15 +571,23 @@ SpdySession3::UncompressAndDiscard(PRUint32 offset,
   unsigned char trash[2048];
   mDownstreamZlib.avail_in = blockLen;
   mDownstreamZlib.next_in = reinterpret_cast<unsigned char *>(blockStart);
+  bool triedDictionary = false;
 
   do {
     mDownstreamZlib.next_out = trash;
     mDownstreamZlib.avail_out = sizeof(trash);
     int zlib_rv = inflate(&mDownstreamZlib, Z_NO_FLUSH);
 
-    if (zlib_rv == Z_NEED_DICT)
+    if (zlib_rv == Z_NEED_DICT) {
+      if (triedDictionary) {
+        LOG3(("SpdySession3::UncompressAndDiscard %p Dictionary Error\n", this));
+        return NS_ERROR_FAILURE;
+      }
+      
+      triedDictionary = true;
       inflateSetDictionary(&mDownstreamZlib, SpdyStream3::kDictionary,
                            sizeof(SpdyStream3::kDictionary));
+    }
 
     if (zlib_rv == Z_DATA_ERROR || zlib_rv == Z_MEM_ERROR)
       return NS_ERROR_FAILURE;

netwerk/protocol/http/SpdyStream3.cpp

@@ -871,6 +871,7 @@ SpdyStream3::Uncompress(z_stream *context,
 
   context->avail_in = blockLen;
   context->next_in = reinterpret_cast<unsigned char *>(blockStart);
+  bool triedDictionary = false;
 
   do {
     context->next_out =
@@ -879,8 +880,15 @@ SpdyStream3::Uncompress(z_stream *context,
     context->avail_out = mDecompressBufferSize - mDecompressBufferUsed;
     int zlib_rv = inflate(context, Z_NO_FLUSH);
 
-    if (zlib_rv == Z_NEED_DICT)
+    if (zlib_rv == Z_NEED_DICT) {
+      if (triedDictionary) {
+        LOG3(("SpdySession3::Uncompress %p Dictionary Error\n", this));
+        return NS_ERROR_FAILURE;
+      }
+      
+      triedDictionary = true;      
       inflateSetDictionary(context, kDictionary, sizeof(kDictionary));
+    }
     
     if (zlib_rv == Z_DATA_ERROR || zlib_rv == Z_MEM_ERROR)
       return NS_ERROR_FAILURE;