Check for invalid use of data frame opcodes.

net/websockets/websocket_channel.h

Index: net/websockets/websocket_channel.h
diff --git a/net/websockets/websocket_channel.h b/net/websockets/websocket_channel.h
index 18734cae677bf9b840d8d2255d02d809a634232d..ce2dc430c0ffafed1a2f204ee53b0502799614ae 100644
--- a/net/websockets/websocket_channel.h
+++ b/net/websockets/websocket_channel.h
@@ -200,6 +200,15 @@ class NET_EXPORT WebSocketChannel {
                            const scoped_refptr<IOBuffer>& data_buffer,
                            size_t size) WARN_UNUSED_RESULT;
 
+  // Forward a received data frame to the renderer, if connected. If
+  // |expecting_continuation| is not equal to |expecting_to_read_continuation_|,
+  // will fail the channel. Also checks the UTF-8 validity of text frames.
+  ChannelState HandleDataFrame(const WebSocketFrameHeader::OpCode opcode,
+                               bool final,
+                               const scoped_refptr<IOBuffer>& data_buffer,
+                               size_t size,
+                               bool expecting_continuation);
+
   // Low-level method to send a single frame. Used for both data and control
   // frames. Either sends the frame immediately or buffers it to be scheduled
   // when the current write finishes. |fin| and |op_code| are defined as for
@@ -319,6 +328,9 @@ class NET_EXPORT WebSocketChannel {
   base::StreamingUtf8Validator incoming_utf8_validator_;
   bool receiving_text_message_;
 
+  // True if we are in the middle of receiving a message.
+  bool expecting_to_read_continuation_;

[tyoshino (SeeGerritForStatus), 2014/02/18 06:24:12]

In this class, "Read" is used for receiving data from the socket. Let's use
handle since this corresponds to HandleFrame() code.

[Adam Rice, 2014/02/18 11:12:43]

Done.

+
   DISALLOW_COPY_AND_ASSIGN(WebSocketChannel);
 };