Skip to content

Generate transfer codings with chunked first and last in the HTTP/1 fuzz - #543

Open
ericmj wants to merge 1 commit into
fuzz-http2-connection-windowfrom
fuzz-http1-transfer-codings
Open

ericmj wants to merge 1 commit into
fuzz-http2-connection-windowfrom
fuzz-http1-transfer-codings

Conversation

@ericmj

@ericmj ericmj commented Oct 16, 2026

Copy link
Copy Markdown
Member

Responses with more than one transfer coding could come up, as a generated Transfer-Encoding: chunked plus a random Transfer-Encoding: gzip header, but no invariant compared the body size Mint delivered with what the framing gives, so treating the first coding as the framing one went unnoticed. Chunked bodies are now also sent with "gzip, chunked", which RFC 9112 section 6.3 frames as chunked, and with "chunked, gzip", whose body is read until the connection closes and includes the chunk framing.

Each generated framing carries the body length it gives, and the model checks the body size of completed responses to the initial requests. That holds when the bytes are unmutated, every initial request was issued, and the response and the ones before it are 1.1 responses to GET or POST with a 200, 404 or 500 status, no 101, and no extra framing headers. Responses to requests issued mid-scenario aren't checked. A response read until close takes the rest of the bytes, so no response after it has a known size.

Responses with more than one transfer coding could come up, as a
generated Transfer-Encoding: chunked plus a random Transfer-Encoding:
gzip header, but no invariant compared the body size Mint delivered with
what the framing gives, so treating the first coding as the framing one
went unnoticed. Chunked bodies are now also sent with "gzip, chunked",
which RFC 9112 section 6.3 frames as chunked, and with "chunked, gzip",
whose body is read until the connection closes and includes the chunk
framing.

Each generated framing carries the body length it gives, and the model
checks the body size of completed responses to the initial requests.
That holds when the bytes are unmutated, every initial request was
issued, and the response and the ones before it are 1.1 responses to
GET or POST with a 200, 404 or 500 status, no 101, and no extra framing
headers. Responses to requests issued mid-scenario aren't checked. A
response read until close takes the rest of the bytes, so no response
after it has a known size.
@ericmj
ericmj added this pull request to stack #544 October 16, 2026 13:10
@coveralls

Copy link
Copy Markdown

Coverage Report for CI Build 5

Coverage decreased (-0.05%) to 90.457%

Details

  • Coverage decreased (-0.05%) from the base build.
  • Patch coverage: No coverable lines changed in this PR.
  • 2 coverage regressions across 1 file.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

2 previously-covered lines in 1 file lost coverage.

File Lines Losing Coverage Coverage
lib/mint/http2.ex 2 95.28%

Coverage Stats

Coverage Status
Relevant Lines: 1970
Covered Lines: 1782
Line Coverage: 90.46%
Coverage Strength: 718.29 hits per line

馃挍 - Coveralls

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants