envoyproxy · twghu · May 10, 2021 · May 10, 2021 · May 10, 2021 · May 11, 2021
diff --git a/...tp/codec_impl_corpus/clusterfuzz-testcase-minimized-codec_impl_fuzz_test-5766628005642240 b/...tp/codec_impl_corpus/clusterfuzz-testcase-minimized-codec_impl_fuzz_test-5766628005642240
diff --git a/test/common/http/codec_impl_fuzz_test.cc b/test/common/http/codec_impl_fuzz_test.cc
@@ -361,7 +361,13 @@ class HttpStream : public LinkedObject<HttpStream> {
         }
       }
       // Perform the stream action.
-      directionalAction(request_, stream_action.request());
+      // The request_.request_encoder_ is initialized from the response_.response_decoder_.
+      // Fuzz test codec_impl_fuzz_test-5766628005642240 created a situation where the response
+      // stream was in closed state leading to the state.request_encoder_ in directionalAction()
+      // kData case no longer being a valid address.
+      if (response_.stream_state_ != HttpStream::StreamState::Closed) {
+        directionalAction(request_, stream_action.request());
+      }
       break;
     }
     case test::common::http::StreamAction::kResponse: {

diff --git a/.../stat_merger_corpus/clusterfuzz-testcase-minimized-stat_merger_fuzz_test-5675276891717632 b/.../stat_merger_corpus/clusterfuzz-testcase-minimized-stat_merger_fuzz_test-5675276891717632
diff --git a/test/common/stats/stat_merger_fuzz_test.cc b/test/common/stats/stat_merger_fuzz_test.cc
@@ -40,6 +40,9 @@ void testDynamicEncoding(absl::string_view data, SymbolTable& symbol_table) {
     // segments, which trigger some inconsistent handling as described in that
     // bug.
     uint32_t num_bytes = (1 + data[index]) & 0x7;
+    if (index == 0 && num_bytes == 0) {
+      return;
+    }
 
     // Carve out the segment and use the 4th bit from the control-byte to
     // determine whether to treat this segment symbolic or not.