HPACK: Check pseudo-header order in decoder.

net/spdy/hpack_decoder.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SPDY_HPACK_DECODER_H_
 #define NET_SPDY_HPACK_DECODER_H_
 
 #include <map>
 #include <string>
 #include <vector>
@@ skipping 59 matching lines @@
  private:
   // Adds the header representation to |decoded_block_|, applying the
   // following rules, as per sections 8.1.3.3 & 8.1.3.4 of the HTTP2 draft
   // specification:
   //  - Multiple values of the Cookie header are joined, delmited by '; '.
   //    This reconstruction is required to properly handle Cookie crumbling.
   //  - Multiple values of other headers are joined and delimited by '\0'.
   //    Note that this may be too accomodating, as the sender's HTTP2 layer
   //    should have already joined and delimited these values.
   //
+  // Returns false if a pseudo-header field follows a regular header one, which
+  // MUST be treated as malformed, as per sections 8.1.2.1. of the HTTP2 draft
+  // specification.
+  //
   // TODO(jgraettinger): This method will eventually emit to the
   // SpdyHeadersHandlerInterface visitor.
-  void HandleHeaderRepresentation(base::StringPiece name,
+  bool HandleHeaderRepresentation(base::StringPiece name,
                                   base::StringPiece value);
 
   const uint32 max_string_literal_size_;
   HpackHeaderTable header_table_;
 
   // Incrementally reconstructed cookie value.
   std::string cookie_value_;
 
   // TODO(jgraettinger): Buffer for headers data, and storage for the last-
   // processed headers block. Both will be removed with the switch to
   // SpdyHeadersHandlerInterface.
   std::string headers_block_buffer_;
   std::map<std::string, std::string> decoded_block_;
 
+  // Flag to keep track of having seen a regular header field.
+  bool regular_header_seen_;
+
   // Huffman table to be applied to decoded Huffman literals,
   // and scratch space for storing those decoded literals.
   const HpackHuffmanTable& huffman_table_;
   std::string key_buffer_, value_buffer_;
 
   // Handlers for decoding HPACK opcodes and header representations
   // (or parts thereof). These methods return true on success and
   // false on error.
   bool DecodeNextOpcode(HpackInputStream* input_stream);
   bool DecodeNextHeaderTableSizeUpdate(HpackInputStream* input_stream);
   bool DecodeNextIndexedHeader(HpackInputStream* input_stream);
   bool DecodeNextLiteralHeader(HpackInputStream* input_stream,
                                bool should_index);
   bool DecodeNextName(HpackInputStream* input_stream,
                       base::StringPiece* next_name);
   bool DecodeNextStringLiteral(HpackInputStream* input_stream,
                                bool is_header_key,  // As distinct from a value.
                                base::StringPiece* output);
 
   DISALLOW_COPY_AND_ASSIGN(HpackDecoder);
 };
 
 }  // namespace net
 
 #endif  // NET_SPDY_HPACK_DECODER_H_