Reset HTTP/2 stream on line-folded response headers.

net/spdy/header_coalescer.cc

Index: net/spdy/header_coalescer.cc
diff --git a/net/spdy/header_coalescer.cc b/net/spdy/header_coalescer.cc
index 1c88fbab6a36a778c4b46e9ae115a583a8849aee..adb5008f051e1ad2751cede0136d53803d4debcf 100644
--- a/net/spdy/header_coalescer.cc
+++ b/net/spdy/header_coalescer.cc
@@ -39,6 +39,13 @@ void HeaderCoalescer::OnHeader(base::StringPiece key, base::StringPiece value) {
     regular_header_seen_ = true;
   }
 
+  // Line folding is forbidden by RFC 7230 Section 3.2.4.

[Ryan Hamilton, 2016/07/27 23:36:58]

Can we simply check for \r\n? It seems like that's an illegal sequence in
HTTP/1.1 since that is the end of line delimiter?

[Bence, 2016/08/01 14:06:17]

I agree.  Done.

+  if (value.find("\r\n ") != base::StringPiece::npos ||
+      value.find("\r\n\t") != base::StringPiece::npos) {
+    error_seen_ = true;
+    return;
+  }
+
   auto iter = headers_.find(key);
   if (iter == headers_.end()) {
     headers_[key] = value;