Skip to content

Safeguard interim header callbacks for unregistered handlers#142

Open
kedar49 wants to merge 1 commit into
google:mainfrom
kedar49:issue-103
Open

Safeguard interim header callbacks for unregistered handlers#142
kedar49 wants to merge 1 commit into
google:mainfrom
kedar49:issue-103

Conversation

@kedar49
Copy link
Copy Markdown

@kedar49 kedar49 commented May 29, 2026

Summary:
This fixes a crash in the simple QUIC client when it receives a valid interim 1xx response and no interim-header callback has been registered. The crash happened because QuicSimpleClientSession always installed a stream callback, but that callback unconditionally invoked an empty session-level MultiUseCallback. The fix routes interim-header delivery through a guarded session helper so missing callbacks become a no-op, while preserving the existing late-binding behavior for streams that were created before a callback is registered.

Changes:

  • quiche/quic/tools/quic_simple_client_session.h
    • Added a private MaybeNotifyInterimHeaders(const quiche::HttpHeaderBlock&) helper declaration.
  • quiche/quic/tools/quic_simple_client_session.cc
    • Changed CreateClientStream() to forward interim headers through MaybeNotifyInterimHeaders(...) instead of directly invoking on_interim_headers_.
    • Added a null check in MaybeNotifyInterimHeaders(...) before invoking the session callback.
  • quiche/quic/core/http/quic_spdy_client_stream_test.cc
    • Added TestQuicSimpleClientSession test scaffolding for exercising the simple-client path.
    • Added InterimResponseWithoutCallbackDoesNotCrashSimpleClient to verify a valid 1xx response is stored without crashing when no callback is registered.
    • Added InterimResponseCallbackUsesLatestSessionHandler to verify late callback registration still works and clearing the callback stops further notifications without affecting interim-header storage.

Testing:

  • Run:
    • git diff --check
    • /home/kedar/.cache/bazelisk/downloads/sha256/7ff2b6a675b59a791d007c526977d5262ade8fa52efc8e0d1ff9e18859909fc0/bin/bazel --output_base=/tmp/quiche-bazel-out --install_base=/tmp/quiche-bazel-install test //quiche:quic_spdy_client_stream_test
  • New test names:
    • InterimResponseWithoutCallbackDoesNotCrashSimpleClient
    • InterimResponseCallbackUsesLatestSessionHandler

Closes #103

Interim 1xx responses can arrive even when the simple client has not
registered a handler yet. Guarding the session callback keeps those
responses from crashing the client while preserving late callback
registration for existing streams.

Fixes google#103
@kedar49
Copy link
Copy Markdown
Author

kedar49 commented May 29, 2026

@RyanTheOptimist you can review and merge this PR

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Null pointer dereference while parsing the HTTP header

1 participant