commit 1685d773ef81420bf747c6988a2ad9baefd126fa
author Yang Gao <yangg@google.com> Wed Apr 29 12:26:00 2015 -0700
committer Yang Gao <yangg@google.com> Wed Apr 29 12:26:00 2015 -0700
tree 1d98532d79c3cb93f1fb20148e769f965759aa9f
parent 50f7b87beca2cd19ec2953eacd3dde2373c9e3db
parent 8a5bce35419abd3d0b51498afcdd091b39683930

Merge pull request #1406 from ctiller/crash-boom-bang

Incoming stream id validation fixes

src/core/transport/chttp2_transport.c

diff --git a/src/core/transport/chttp2_transport.c b/src/core/transport/chttp2_transport.c
index 26c550c..3ae6931 100644
--- a/src/core/transport/chttp2_transport.c
+++ b/src/core/transport/chttp2_transport.c
@@ -1392,7 +1392,10 @@
       gpr_log(GPR_ERROR,
               "ignoring out of order new stream request on server; last stream "
               "id=%d, new stream id=%d",
-              t->last_incoming_stream_id, t->incoming_stream);
+              t->last_incoming_stream_id, t->incoming_stream_id);
+      return init_skip_frame(t, 1);
+    } else if ((t->incoming_stream_id & 1) == 0) {
+      gpr_log(GPR_ERROR, "ignoring stream with non-client generated index %d", t->incoming_stream_id);
       return init_skip_frame(t, 1);
     }
     t->incoming_stream = NULL;