tree f036359e76ab46ff1bf4ee8718b820f2eb49e250
parent 8968c61983e8f51a91b8c0ef25bf739278c89634
author Brad Fitzpatrick <bradfitz@golang.org> 1455328536 +0000
committer Brad Fitzpatrick <bradfitz@golang.org> 1455329009 +0000

http2: fix crash in Transport on double Read of invalid gzip Response.Body

This old code was buggy:

type gzipReader struct {
        body io.ReadCloser // underlying Response.Body
        zr   io.Reader     // lazily-initialized gzip reader
}

func (gz *gzipReader) Read(p []byte) (n int, err error) {
        if gz.zr == nil {
                gz.zr, err = gzip.NewReader(gz.body)
                if err != nil {
                        return 0, err
                }
        }
        return gz.zr.Read(p)
}

If a Read on a gzipped Response.Body (of type *http2.gzipReader)
resulted in gzip.NewReader returning an error, gzipReader assigned
a *gzip.Reader-typed nil value to the gz.zr interface value.

On a subsequent Read, gz.zr would not be equal to ==, because it was
actually equal to (type *gzip.Reader, nil), and then zr.Read would call
(*gzip.Reader).Read with a nil receiver and explode.

Debugged internally. (http://go/http2gzipbug)

Change-Id: Icba040ace8ffac3536e5e7ade6695c7660838ca1