Huffman : Fatal Exception: java.lang.NullPointerException

[danhdanh]

I'm facing this issue on all version android ( 7 , 9 , 10 , 11 , 12, 13, 14 ,...) ,

implementation 'com.squareup.okhttp3:okhttp:4.10.0'
or
implementation 'com.squareup.okhttp3:okhttp:4.12.0'

okhttp3.internal.http2.Huffman.decode (Huffman.kt:133)
okhttp3.internal.http2.Hpack$Reader.readByteString (Hpack.kt:374)
okhttp3.internal.http2.Hpack$Reader.readLiteralHeaderWithIncrementalIndexingIndexedName (Hpack.kt:271)
okhttp3.internal.http2.Hpack$Reader.readHeaders (Hpack.kt:212)
okhttp3.internal.http2.Http2Reader.readHeaderBlock (Http2Reader.kt:165)
okhttp3.internal.http2.Http2Reader.readHeaders (Http2Reader.kt:150)
okhttp3.internal.http2.Http2Reader.nextFrame (Http2Reader.kt:123)
okhttp3.internal.http2.Http2Connection$ReaderRunnable.invoke (Http2Connection.kt:618)
okhttp3.internal.http2.Http2Connection$ReaderRunnable.invoke (Http2Connection.kt:609)
okhttp3.internal.concurrent.TaskQueue$execute$1.runOnce (TaskQueue.kt:102)
okhttp3.internal.concurrent.TaskRunner.runTask (TaskRunner.kt:117)
okhttp3.internal.concurrent.TaskRunner.access$runTask (TaskRunner.kt:42)
okhttp3.internal.concurrent.TaskRunner$runnable$1.run (TaskRunner.kt:66)
java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1167)
java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:641)
java.lang.Thread.run (Thread.java:923)

please help me to figure it out. Thanks

[swankjesse]

Could you share the server URL you’re getting this error on? Does this error reproduce consistently?

It’s well-exercised code and so more information will help to diagnose & fix this crash?

Alternately, we could try to fuzz the Huffman class to trigger this. What we’re doing seems a bit prone to this kind of crash.

      while (accumulatorBitCount >= 8) {
        val childIndex = (accumulator ushr (accumulatorBitCount - 8)) and 0xff
        node = node.children!![childIndex]!! // ---- this is the line of the crash
        if (node.children == null) {
          // Terminal node.
          sink.writeByte(node.symbol)
          accumulatorBitCount -= node.terminalBitCount
          node = root
        } else {
          // Non-terminal node.
          accumulatorBitCount -= 8
        }
      }

[yschimke]

If this is because of bad input, we should probably verify as you suggest, but turn these into IOExceptions. The NPE isn't the right thing to expose.

[danhdanh]

It doesn't happen often, I got this log a lot on firebase but haven't been able to reproduce it. This crash error also has a log like this:
okhttp3.internal.http2.Huffman.decode (Huffman.kt:133)
okhttp3.internal.http2.Hpack$Reader.readByteString (Hpack.kt:374)
okhttp3.internal.http2.Hpack$Reader.readLiteralHeaderWithoutIndexingNewName (Hpack.kt:263)
okhttp3.internal.http2.Hpack$Reader.readHeaders (Hpack.kt:224)

node = node.children!![childIndex]!! // ---- this is the line of the crash
I don't know which case could lead to node or node.children or node.children!![childIndex]!! cause crashes