Fix a theoretical bug where a short request packet yields an oob read

1 files changed, 16 insertions, 0 deletions

diff --git a/tests/integration/test_keepalive.py b/tests/integration/test_keepalive.py
index 2c724fc..f9aa468 100644
--- a/tests/integration/test_keepalive.py
+++ b/tests/integration/test_keepalive.py
@@ -107,6 +107,22 @@ class KeepAlive(TrackerTestCase):
         finally:
             c.close()
 
+    def test_a_tiny_split_request_does_not_overread(self):
+        """A request that arrives in pieces and completes as a buffer shorter
+        than the dispatch literals (\"GET /\" etc.) used to read past the
+        exactly sized buffer. It must be rejected without a sanitizer hit."""
+        c = self.tracker.connect()
+        try:
+            c.sock.sendall(b"\r\n")
+            time.sleep(0.05)
+            c.sock.sendall(b"\r\n")          # completes as a 4-byte buffer
+            time.sleep(0.1)
+        finally:
+            c.close()
+        # the tracker must still answer; tearDown's stop() surfaces any sanitizer abort
+        answer = self.tracker.announce(self.hash_for("after-tiny"), port=6881, left=0)
+        self.assertNotIn(b"failure reason", answer, "the tracker stopped serving after a tiny request")
+
     def test_a_split_request_answered_by_a_worker_does_not_spin(self):
         """A reply that a worker produces does not go through the send path,
         so the request stays in the buffer the read loop is reading. The loop