Index: net/spdy/spdy_framer.cc |
diff --git a/net/spdy/spdy_framer.cc b/net/spdy/spdy_framer.cc |
index ea5eaa564b3b9b92667fd03bac10d1f59ce1a943..49a73a581eb54b9ba929e5c5fa76aaa990e6df29 100644 |
--- a/net/spdy/spdy_framer.cc |
+++ b/net/spdy/spdy_framer.cc |
@@ -2056,8 +2056,9 @@ size_t SpdyFramer::ProcessAltSvcFramePayload(const char* data, size_t len) { |
reader.ReadUInt8(&altsvc_scratch_.pid_len); |
DCHECK(successful_read); |
// Sanity check length value. |
- if (GetAltSvcMinimumSize() + altsvc_scratch_.pid_len >= |
- current_frame_length_) { |
+ if (altsvc_scratch_.pid_len == 0 || |
+ GetAltSvcMinimumSize() + altsvc_scratch_.pid_len >= |
+ current_frame_length_) { |
set_error(SPDY_INVALID_CONTROL_FRAME); |
return 0; |
} |