Check for invalid use of data frame opcodes.

net/websockets/websocket_channel.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_WEBSOCKETS_WEBSOCKET_CHANNEL_H_
 #define NET_WEBSOCKETS_WEBSOCKET_CHANNEL_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 182 matching lines @@
       scoped_ptr<WebSocketFrame> frame) WARN_UNUSED_RESULT;
 
   // Handles a frame that the object has received enough of to process. May call
   // |event_interface_| methods, send responses to the server, and change the
   // value of |state_|.
   ChannelState HandleFrame(const WebSocketFrameHeader::OpCode opcode,
                            bool final,
                            const scoped_refptr<IOBuffer>& data_buffer,
                            size_t size) WARN_UNUSED_RESULT;
 
+  // Forward a received data frame to the renderer, if connected. If
+  // |expecting_continuation| is not equal to |expecting_to_read_continuation_|,
+  // will fail the channel. Also checks the UTF-8 validity of text frames.
+  ChannelState HandleDataFrame(const WebSocketFrameHeader::OpCode opcode,
+                               bool final,
+                               const scoped_refptr<IOBuffer>& data_buffer,
+                               size_t size,
+                               bool expecting_continuation);
+
   // Low-level method to send a single frame. Used for both data and control
   // frames. Either sends the frame immediately or buffers it to be scheduled
   // when the current write finishes. |fin| and |op_code| are defined as for
   // SendFrame() above, except that |op_code| may also be a control frame
   // opcode.
   ChannelState SendIOBuffer(bool fin,
                             WebSocketFrameHeader::OpCode op_code,
                             const scoped_refptr<IOBuffer>& buffer,
                             size_t size) WARN_UNUSED_RESULT;
 
@@ skipping 99 matching lines @@
   scoped_ptr<HandshakeNotificationSender> notification_sender_;
 
   // UTF-8 validator for outgoing Text messages.
   base::StreamingUtf8Validator outgoing_utf8_validator_;
   bool sending_text_message_;
 
   // UTF-8 validator for incoming Text messages.
   base::StreamingUtf8Validator incoming_utf8_validator_;
   bool receiving_text_message_;
 
+  // True if we are in the middle of receiving a message.
+  bool expecting_to_read_continuation_;

[tyoshino (SeeGerritForStatus), 2014/02/18 06:24:12]

In this class, "Read" is used for receiving data from the socket. Let's use
handle since this corresponds to HandleFrame() code.

[Adam Rice, 2014/02/18 11:12:43]

Done.

+
   DISALLOW_COPY_AND_ASSIGN(WebSocketChannel);
 };
 
 }  // namespace net
 
 #endif  // NET_WEBSOCKETS_WEBSOCKET_CHANNEL_H_