HTTP/2 Check header names in HeaderCoalescer

net/spdy/header_coalescer.cc

Index: net/spdy/header_coalescer.cc
diff --git a/net/spdy/header_coalescer.cc b/net/spdy/header_coalescer.cc
index 497c07991983a5423c77a16b6e4178d74736521d..a1561135ec0ef913f4bb135514e6855596885f72 100644
--- a/net/spdy/header_coalescer.cc
+++ b/net/spdy/header_coalescer.cc
@@ -7,6 +7,7 @@
 #include <utility>
 
 #include "base/strings/string_util.h"
+#include "net/http/http_util.h"
 #include "net/spdy/platform/api/spdy_estimate_memory_usage.h"
 
 namespace net {
@@ -24,6 +25,11 @@ void HeaderCoalescer::OnHeader(base::StringPiece key, base::StringPiece value) {
     return;
   }
 
+  if (!HttpUtil::IsValidHeaderName(key)) {
+    error_seen_ = true;
+    return;
+  }
+
   // 32 byte overhead according to RFC 7540 Section 6.5.2.
   header_list_size_ += key.size() + value.size() + 32;
   if (header_list_size_ > kMaxHeaderListSize) {