diff options
| author | vandebo@chromium.org <vandebo@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-11-23 21:31:12 +0000 |
|---|---|---|
| committer | vandebo@chromium.org <vandebo@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2009-11-23 21:31:12 +0000 |
| commit | e22e136b67ca8ec02722c28964572b2328a4b33d (patch) | |
| tree | 8024788e1580d6830e269905d16f134e3ad8f4cf /net/http/http_stream.h | |
| parent | e53f536b1bc1965fa62e6056783d40d38360be9e (diff) | |
| download | chromium_src-e22e136b67ca8ec02722c28964572b2328a4b33d.zip chromium_src-e22e136b67ca8ec02722c28964572b2328a4b33d.tar.gz chromium_src-e22e136b67ca8ec02722c28964572b2328a4b33d.tar.bz2 | |
A large Content-Length header followed by a connection close could trigger an out of memory condition. Fixed problem, added unit test, and clarified the API. This is probably the real problem in issue 25826.
BUG=28346, 25826
TEST=HttpNetworkTransactionTest.LargeContentLengthThenReset
Review URL: http://codereview.chromium.org/418035
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@32856 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'net/http/http_stream.h')
| -rw-r--r-- | net/http/http_stream.h | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/net/http/http_stream.h b/net/http/http_stream.h index d0b9dc9..329db5a 100644 --- a/net/http/http_stream.h +++ b/net/http/http_stream.h @@ -50,13 +50,14 @@ class HttpStream { // Provides access to HttpResponseInfo (owned by HttpStream). virtual HttpResponseInfo* GetResponseInfo() const = 0; - // Reads response body data, up to |buf_len| bytes. The number of bytes read - // is returned, or an error is returned upon failure. ERR_CONNECTION_CLOSED - // is returned to indicate end-of-connection. ERR_IO_PENDING is returned if - // the operation could not be completed synchronously, in which case the - // result will be passed to the callback when available. If the operation is - // not completed immediately, the socket acquires a reference to the provided - // buffer until the callback is invoked or the socket is destroyed. + // Reads response body data, up to |buf_len| bytes. |buf_len| should be a + // reasonable size (<256KB). The number of bytes read is returned, or an + // error is returned upon failure. ERR_CONNECTION_CLOSED is returned to + // indicate end-of-connection. ERR_IO_PENDING is returned if the operation + // could not be completed synchronously, in which case the result will be + // passed to the callback when available. If the operation is not completed + // immediately, the socket acquires a reference to the provided buffer until + // the callback is invoked or the socket is destroyed. virtual int ReadResponseBody(IOBuffer* buf, int buf_len, CompletionCallback* callback) = 0; |