Check for invalid use of data frame opcodes.

net/websockets/websocket_channel.h

Index: net/websockets/websocket_channel.h
diff --git a/net/websockets/websocket_channel.h b/net/websockets/websocket_channel.h
index 18734cae677bf9b840d8d2255d02d809a634232d..13fa7c70b58e7279513f62c3ae770b5016a89f6c 100644
--- a/net/websockets/websocket_channel.h
+++ b/net/websockets/websocket_channel.h
@@ -200,6 +200,14 @@ class NET_EXPORT WebSocketChannel {
                            const scoped_refptr<IOBuffer>& data_buffer,
                            size_t size) WARN_UNUSED_RESULT;
 
+  // Forward a received data frame to the renderer, if connected. If
+  // |expecting_continuation| is not equal to |expecting_to_read_continuation_|,
+  // will fail the channel. Also checks the UTF-8 validity of text frames.
+  ChannelState HandleDataFrame(const WebSocketFrameHeader::OpCode opcode,
+                               bool final,
+                               const scoped_refptr<IOBuffer>& data_buffer,
+                               size_t size);
+
   // Low-level method to send a single frame. Used for both data and control
   // frames. Either sends the frame immediately or buffers it to be scheduled
   // when the current write finishes. |fin| and |op_code| are defined as for
@@ -319,6 +327,9 @@ class NET_EXPORT WebSocketChannel {
   base::StreamingUtf8Validator incoming_utf8_validator_;
   bool receiving_text_message_;
 
+  // True if we are in the middle of receiving a message.
+  bool expecting_to_handle_continuation_;
+
   DISALLOW_COPY_AND_ASSIGN(WebSocketChannel);
 };