| Index: net/spdy/spdy_framer.cc
|
| diff --git a/net/spdy/spdy_framer.cc b/net/spdy/spdy_framer.cc
|
| index ea5eaa564b3b9b92667fd03bac10d1f59ce1a943..49a73a581eb54b9ba929e5c5fa76aaa990e6df29 100644
|
| --- a/net/spdy/spdy_framer.cc
|
| +++ b/net/spdy/spdy_framer.cc
|
| @@ -2056,8 +2056,9 @@ size_t SpdyFramer::ProcessAltSvcFramePayload(const char* data, size_t len) {
|
| reader.ReadUInt8(&altsvc_scratch_.pid_len);
|
| DCHECK(successful_read);
|
| // Sanity check length value.
|
| - if (GetAltSvcMinimumSize() + altsvc_scratch_.pid_len >=
|
| - current_frame_length_) {
|
| + if (altsvc_scratch_.pid_len == 0 ||
|
| + GetAltSvcMinimumSize() + altsvc_scratch_.pid_len >=
|
| + current_frame_length_) {
|
| set_error(SPDY_INVALID_CONTROL_FRAME);
|
| return 0;
|
| }
|
|
|