SPDY: Catch another edge case in version validation.

net/spdy/spdy_framer.cc

Index: net/spdy/spdy_framer.cc
diff --git a/net/spdy/spdy_framer.cc b/net/spdy/spdy_framer.cc
index 3ee66bc195b0c0bb7afc1b3909ca33e1b7315586..c0f214cb15d0db883431c22d3e4fc6bc88e25d02 100644
--- a/net/spdy/spdy_framer.cc
+++ b/net/spdy/spdy_framer.cc
@@ -634,13 +634,22 @@ size_t SpdyFramer::ProcessCommonHeader(const char* data, size_t len) {
     DCHECK(successful_read);
     is_control_frame = (version & kControlFlagMask) != 0;
     version &= ~kControlFlagMask;  // Only valid for control frames.
-    if (is_control_frame &&
-        version >= SpdyConstants::SerializeMajorVersion(SPDY_MIN_VERSION) &&
-        version <= SpdyConstants::SerializeMajorVersion(SPDY_MAX_VERSION)) {
-      version = SpdyConstants::ParseMajorVersion(version);
-    }
-
     if (is_control_frame) {
+      // We check version before we check validity: version can never be
+      // 'invalid', it can only be unsupported.
+      if (version < SpdyConstants::SerializeMajorVersion(SPDY_MIN_VERSION) ||
+          version > SpdyConstants::SerializeMajorVersion(SPDY_MAX_VERSION) ||
+          SpdyConstants::ParseMajorVersion(version) != protocol_version()) {
+        // Version does not match the version the framer was initialized with.
+        DVLOG(1) << "Unsupported SPDY version "
+                 << version
+                 << " (expected " << protocol_version() << ")";
+        set_error(SPDY_UNSUPPORTED_VERSION);
+        return 0;
+      } else {
+        // Convert version from wire format to SpdyMajorVersion.
+        version = SpdyConstants::ParseMajorVersion(version);
+      }
       // We check control_frame_type_field's validity in
       // ProcessControlFrameHeader().
       successful_read = reader->ReadUInt16(&control_frame_type_field);
@@ -756,13 +765,6 @@ size_t SpdyFramer::ProcessCommonHeader(const char* data, size_t len) {
         CHANGE_STATE(SPDY_AUTO_RESET);
       }
     }
-  } else if (version != protocol_version()) {
-    // We check version before we check validity: version can never be
-    // 'invalid', it can only be unsupported.
-    DVLOG(1) << "Unsupported SPDY version "
-             << version
-             << " (expected " << protocol_version() << ")";
-    set_error(SPDY_UNSUPPORTED_VERSION);
   } else {
     ProcessControlFrameHeader(control_frame_type_field);
   }