server: fix handling of RPC timeouts that overflow int64 nanos

Author: dfawley

Diff for: internal/transport/http_util.go

@@ -24,6 +24,7 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
+	"math"
 	"net"
 	"net/http"
 	"strconv"
@@ -435,6 +436,10 @@ func decodeTimeout(s string) (time.Duration, error) {
 	if size < 2 {
 		return 0, fmt.Errorf("transport: timeout string is too short: %q", s)
 	}
+	if size > 9 {
+		// Spec allows for 8 digits plus the unit.
+		return 0, fmt.Errorf("transport: timeout string is too long: %q", s)
+	}
 	unit := timeoutUnit(s[size-1])
 	d, ok := timeoutUnitToDuration(unit)
 	if !ok {
@@ -444,6 +449,11 @@ func decodeTimeout(s string) (time.Duration, error) {
 	if err != nil {
 		return 0, err
 	}
+	const maxHours = math.MaxInt64 / int64(time.Hour)
+	if d == time.Hour && t > maxHours {
+		// This timeout would overflow math.MaxInt64; clamp it.
+		return time.Duration(math.MaxInt64), nil
+	}
 	return d * time.Duration(t), nil
 }
 

Diff for: test/end2end_test.go

@@ -6778,3 +6778,46 @@ func TestNetPipeConn(t *testing.T) {
 		t.Fatalf("UnaryCall(_) = _, %v; want _, nil", err)
 	}
 }
+
+func TestLargeTimeout(t *testing.T) {
+	defer leakcheck.Check(t)
+	for _, e := range listTestEnv() {
+		testLargeTimeout(t, e)
+	}
+}
+
+func testLargeTimeout(t *testing.T, e env) {
+	te := newTest(t, e)
+	te.declareLogNoise("Server.processUnaryRPC failed to write status")
+
+	ts := &funcServer{}
+	te.startServer(ts)
+	defer te.tearDown()
+	tc := testpb.NewTestServiceClient(te.clientConn())
+
+	timeouts := []time.Duration{
+		time.Duration(math.MaxInt64), // will be (correctly) converted to
+		// 2562048 hours, which overflows upon converting back to an int64
+		2562047 * time.Hour, // the largest timeout that does not overflow
+	}
+
+	for i, maxTimeout := range timeouts {
+		ts.unaryCall = func(ctx context.Context, in *testpb.SimpleRequest) (*testpb.SimpleResponse, error) {
+			deadline, ok := ctx.Deadline()
+			timeout := deadline.Sub(time.Now())
+			minTimeout := maxTimeout - 5*time.Second
+			if !ok || timeout < minTimeout || timeout > maxTimeout {
+				t.Errorf("ctx.Deadline() = (now+%v), %v; want [%v, %v], true", timeout, ok, minTimeout, maxTimeout)
+				return nil, status.Error(codes.OutOfRange, "deadline error")
+			}
+			return &testpb.SimpleResponse{}, nil
+		}
+
+		ctx, cancel := context.WithTimeout(context.Background(), maxTimeout)
+		defer cancel()
+
+		if _, err := tc.UnaryCall(ctx, &testpb.SimpleRequest{}); err != nil {
+			t.Errorf("case %v: UnaryCall(_) = _, %v; want _, nil", i, err)
+		}
+	}
+}