Skip to content

HTTP2: sending multiple subsequent HTTP2 'HEADERS' frames causes crash on gRPC server #14175

@matej-staron

Description

@matej-staron

Should this be an issue in the gRPC issue tracker?

Yes.

What version of gRPC and what language are you using?

Python, gRPC 1.8.4

What operating system (Linux, Windows, …) and version?

CentOS release 6.6 (Final)
Linux 2.6.32-504.30.3.el6.x86_64 #1 SMP x86_64 x86_64 x86_64 GNU/Linux

What runtime / compiler are you using (e.g. python version or version of gcc)

Python 2.7.11, GCC 4.4.7

What did you do?

When checking how a simple Python server handles invalid HTTP2 requests, I observed server crash caused by duplicating HEADERS frame (valid by itself) in client request (i.e. HTTP2 frame sequence HEADERS + HEADERS + DATA). This issue is reproducible and it is present also on older gRPC versions (since 1.0.0). In case the second HEADERS frame is empty (has no payload), the crash does not occur.

I am attaching the server debug log, although it does not provide much information other than the second HEADERS frame is treated as 'trailing metadata' - the only difference when compared to the log of a valid RPC are the extra lines 347-371.

server_log_dupl_hdrs.txt

When checking in wireshark, server does not send any frames and closes the TCP connection immediately (FIN).

Metadata

Metadata

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions