net::WebSocketChannel should reject reserved bits

net/websockets/websocket_channel.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/websockets/websocket_channel.h"
 
 #include <algorithm>
 
 #include "base/basictypes.h"  // for size_t
 #include "base/bind.h"
@@ skipping 635 matching lines @@
   }
   const WebSocketFrameHeader::OpCode opcode = frame->header.opcode;
   if (WebSocketFrameHeader::IsKnownControlOpCode(opcode) &&
       !frame->header.final) {
     return FailChannel(
         base::StringPrintf("Received fragmented control frame: opcode = %d",
                            opcode),
         kWebSocketErrorProtocolError,
         "Control message with FIN bit unset received");
   }
+  if (frame->header.reserved1 || frame->header.reserved2 ||
+      frame->header.reserved3) {
+    return FailChannel("Received a frame with an invalid reserved bit set.",
+                       kWebSocketErrorProtocolError,
+                       "Invalid reserved bit");
+  }
 
   // Respond to the frame appropriately to its type.
   return HandleFrameByState(
       opcode, frame->header.final, frame->data, frame->header.payload_length);
 }
 
 ChannelState WebSocketChannel::HandleFrameByState(
     const WebSocketFrameHeader::OpCode opcode,
     bool final,
     const scoped_refptr<IOBuffer>& data_buffer,
@@ skipping 276 matching lines @@
 
 void WebSocketChannel::CloseTimeout() {
   stream_->Close();
   DCHECK_NE(CLOSED, state_);
   state_ = CLOSED;
   AllowUnused(DoDropChannel(false, kWebSocketErrorAbnormalClosure, ""));
   // |this| has been deleted.
 }
 
 }  // namespace net