HttpServer WebSocket: don't crash on data before server handshake

net/server/web_socket.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/server/web_socket.h"
 
 #include <vector>
 
 #include "base/base64.h"
 #include "base/logging.h"
@@ skipping 80 matching lines @@
     }
   }
   server_->SendRaw(connection_->id(),
                    ValidResponseString(encoded_hash, response_extensions));
 }
 
 WebSocket::ParseResult WebSocket::Read(std::string* message) {
   if (closed_)
     return FRAME_CLOSE;
 
+  if (!encoder_) {
+    // RFC6455, section 4.1 says "Once the client's opening handshake has been
+    // sent, the client MUST wait for a response from the server before sending
+    // any further data". If |encoder_| is null here, ::Accept either has not
+    // been called at all, or has rejected a request rather than producing
+    // a server handshake. Either way, the client clearly couldn't have gotten
+    // a proper server handshake, so error out, especially since this method
+    // can't proceed without an |encoder_|.
+    return FRAME_ERROR;
+  }
+
   HttpConnection::ReadIOBuffer* read_buf = connection_->read_buf();
   base::StringPiece frame(read_buf->StartOfBuffer(), read_buf->GetSize());
   int bytes_consumed = 0;
   ParseResult result = encoder_->DecodeFrame(frame, &bytes_consumed, message);
   if (result == FRAME_OK)
     read_buf->DidConsume(bytes_consumed);
   if (result == FRAME_CLOSE)
     closed_ = true;
   return result;
 }
@@ skipping 13 matching lines @@
 }
 
 void WebSocket::SendErrorResponse(const std::string& message) {
   if (closed_)
     return;
   closed_ = true;
   server_->Send500(connection_->id(), message);
 }
 
 }  // namespace net