SPDY: Catch another edge case in version validation.

net/spdy/spdy_framer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_framer.h"
 
 #include "base/lazy_instance.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/metrics/stats_counters.h"
 #include "base/strings/string_util.h"
@@ skipping 616 matching lines @@
 
   uint16 control_frame_type_field = DATA;
   // ProcessControlFrameHeader() will set current_frame_type_ to the
   // correct value if this is a valid control frame.
   current_frame_type_ = DATA;
   if (protocol_version() <= SPDY3) {
     bool successful_read = reader->ReadUInt16(&version);
     DCHECK(successful_read);
     is_control_frame = (version & kControlFlagMask) != 0;
     version &= ~kControlFlagMask;  // Only valid for control frames.
-    if (is_control_frame &&
-        version >= SpdyConstants::SerializeMajorVersion(SPDY_MIN_VERSION) &&
-        version <= SpdyConstants::SerializeMajorVersion(SPDY_MAX_VERSION)) {
-      version = SpdyConstants::ParseMajorVersion(version);
-    }
-
     if (is_control_frame) {
+      // We check version before we check validity: version can never be
+      // 'invalid', it can only be unsupported.
+      if (version < SpdyConstants::SerializeMajorVersion(SPDY_MIN_VERSION) ||
+          version > SpdyConstants::SerializeMajorVersion(SPDY_MAX_VERSION) ||
+          SpdyConstants::ParseMajorVersion(version) != protocol_version()) {
+        // Version does not match the version the framer was initialized with.
+        DVLOG(1) << "Unsupported SPDY version "
+                 << version
+                 << " (expected " << protocol_version() << ")";
+        set_error(SPDY_UNSUPPORTED_VERSION);
+        return 0;
+      } else {
+        // Convert version from wire format to SpdyMajorVersion.
+        version = SpdyConstants::ParseMajorVersion(version);
+      }
       // We check control_frame_type_field's validity in
       // ProcessControlFrameHeader().
       successful_read = reader->ReadUInt16(&control_frame_type_field);
     } else {
       reader->Rewind();
       successful_read = reader->ReadUInt31(&current_frame_stream_id_);
     }
     DCHECK(successful_read);
 
     successful_read = reader->ReadUInt8(&current_frame_flags_);
@@ skipping 95 matching lines @@
         CHANGE_STATE(SPDY_READ_PADDING_LENGTH);
       } else {
         // Empty data frame.
         if (current_frame_flags_ & DATA_FLAG_FIN) {
           visitor_->OnStreamFrameData(
               current_frame_stream_id_, NULL, 0, true);
         }
         CHANGE_STATE(SPDY_AUTO_RESET);
       }
     }
-  } else if (version != protocol_version()) {
-    // We check version before we check validity: version can never be
-    // 'invalid', it can only be unsupported.
-    DVLOG(1) << "Unsupported SPDY version "
-             << version
-             << " (expected " << protocol_version() << ")";
-    set_error(SPDY_UNSUPPORTED_VERSION);
   } else {
     ProcessControlFrameHeader(control_frame_type_field);
   }
 
   return original_len - len;
 }
 
 void SpdyFramer::ProcessControlFrameHeader(uint16 control_frame_type_field) {
   DCHECK_EQ(SPDY_NO_ERROR, error_code_);
   DCHECK_LE(GetControlFrameHeaderSize(), current_frame_buffer_length_);
@@ skipping 2210 matching lines @@
   builder->Seek(compressed_size);
   builder->RewriteLength(*this);
 
   pre_compress_bytes.Add(uncompressed_len);
   post_compress_bytes.Add(compressed_size);
 
   compressed_frames.Increment();
 }
 
 }  // namespace net