-
Notifications
You must be signed in to change notification settings - Fork 11.1k
HTTP2: sending multiple subsequent HTTP2 'HEADERS' frames causes crash on gRPC server #14175
Description
Should this be an issue in the gRPC issue tracker?
Yes.
What version of gRPC and what language are you using?
Python, gRPC 1.8.4
What operating system (Linux, Windows, …) and version?
CentOS release 6.6 (Final)
Linux 2.6.32-504.30.3.el6.x86_64 #1 SMP x86_64 x86_64 x86_64 GNU/Linux
What runtime / compiler are you using (e.g. python version or version of gcc)
Python 2.7.11, GCC 4.4.7
What did you do?
When checking how a simple Python server handles invalid HTTP2 requests, I observed server crash caused by duplicating HEADERS frame (valid by itself) in client request (i.e. HTTP2 frame sequence HEADERS + HEADERS + DATA). This issue is reproducible and it is present also on older gRPC versions (since 1.0.0). In case the second HEADERS frame is empty (has no payload), the crash does not occur.
I am attaching the server debug log, although it does not provide much information other than the second HEADERS frame is treated as 'trailing metadata' - the only difference when compared to the log of a valid RPC are the extra lines 347-371.
When checking in wireshark, server does not send any frames and closes the TCP connection immediately (FIN).