x/net/spdy: fatal error: runtime: out of memory

[Dmitry Vyukov]

The following program crashes:

package main

import (
    "bytes"
    "encoding/hex"
    "golang.org/x/net/spdy"
    "io/ioutil"
)

func main() {
    data, _ := hex.DecodeString("80030008000000140000002a78f9e3c6a7c202230600000000ffff")
    framer, err := spdy.NewFramer(ioutil.Discard, bytes.NewReader(data))
    if err != nil {
        panic(err)
    }
    for score := 0; ; score++ {
        f, err := framer.ReadFrame()
        if err != nil {
            if f != nil {
                panic(err)
            }
            return
        }
        err = framer.WriteFrame(f)
        if err != nil {
            panic(err)
        }
    }
}

fatal error: runtime: out of memory

goroutine 1 [running]:
runtime.systemstack_switch()
    src/runtime/asm_amd64.s:216 fp=0xc20804f928 sp=0xc20804f920
runtime.mallocgc(0x1500000000, 0x6b4880, 0xc200000000, 0x40afc5)
    src/runtime/malloc.go:632 +0x8d9 fp=0xc20804f9f8 sp=0xc20804f928
runtime.newarray(0x6b4880, 0x10000000, 0xc20800ad10)
    src/runtime/malloc.go:742 +0xce fp=0xc20804fa38 sp=0xc20804f9f8
runtime.makemap(0x6de920, 0x3d302e3d, 0x0, 0x0, 0x627b40)
    src/runtime/hashmap.go:246 +0x34e fp=0xc20804fa98 sp=0xc20804fa38
golang.org/x/net/spdy.parseHeaderValueBlock(0x7faa1458c6f0, 0xc2080124b0, 0xc20000002a, 0x7faa1458c6f0, 0x0, 0x0)
    src/golang.org/x/net/spdy/read.go:183 +0x173 fp=0xc20804fc38 sp=0xc20804fa98
golang.org/x/net/spdy.(*Framer).readHeadersFrame(0xc2080201e0, 0x80003, 0xc200000014, 0xc20800e8c0, 0x0, 0x0)
    src/golang.org/x/net/spdy/read.go:307 +0x24d fp=0xc20804fd58 sp=0xc20804fc38
golang.org/x/net/spdy.(*HeadersFrame).read(0xc20800e8c0, 0x7f0000080003, 0xc200000014, 0xc2080201e0, 0x0, 0x0)
    src/golang.org/x/net/spdy/read.go:92 +0x65 fp=0xc20804fd90 sp=0xc20804fd58
golang.org/x/net/spdy.(*Framer).parseControlFrame(0xc2080201e0, 0xc200080003, 0x0, 0x0, 0x0, 0x0)
    src/golang.org/x/net/spdy/read.go:171 +0x238 fp=0xc20804fe38 sp=0xc20804fd90
golang.org/x/net/spdy.(*Framer).ReadFrame(0xc2080201e0, 0x0, 0x0, 0x0, 0x0)
    src/golang.org/x/net/spdy/read.go:154 +0x18a fp=0xc20804fec8 sp=0xc20804fe38
main.main()
    /tmp/spdy.go:17 +0x19d fp=0xc20804ff90 sp=0xc20804fec8

on commit 6f62f426de90c0ed6a55207b51476115fcb17237

[Dmitry Vyukov]

This "80300008303030303030303078f9e3c6a7c2023a1030303030303030303000303030" crashes with "panic: runtime: allocation size out of range" but in the same stack. Probably the same bug. But need to verify.