Prevent buffer overflow in QuicSimpleServerSession::HandleRstOnValidNonexistentStream

This fix is based on code from <liujiyong4@gmail.com>, thanks to them for reporting the issue and proposing a fix.

The issue here was that this code was using DCHECKs to validate input from the network instead of failing gracefully. QuicSimpleServerSession is not used in production so this code does not require flag protection.

PiperOrigin-RevId: 344319749
Change-Id: Ic0f14412ea5e2b398b48cb3d2333c2e1e01d6d35
diff --git a/quic/tools/quic_simple_server_session.cc b/quic/tools/quic_simple_server_session.cc
index 72d6259..dd0e5ad 100644
--- a/quic/tools/quic_simple_server_session.cc
+++ b/quic/tools/quic_simple_server_session.cc
@@ -157,14 +157,15 @@
     // Since PromisedStreamInfo are queued in sequence, the corresponding
     // index for it in promised_streams_ can be calculated.
     QuicStreamId next_stream_id = next_outgoing_unidirectional_stream_id();
-    if (VersionHasIetfQuicFrames(transport_version())) {
-      DCHECK(!QuicUtils::IsBidirectionalStreamId(frame.stream_id, version()));
+    if ((!version().HasIetfQuicFrames() ||
+         !QuicUtils::IsBidirectionalStreamId(frame.stream_id, version())) &&
+        frame.stream_id >= next_stream_id) {
+      size_t index = (frame.stream_id - next_stream_id) /
+                     QuicUtils::StreamIdDelta(transport_version());
+      if (index <= promised_streams_.size()) {
+        promised_streams_[index].is_cancelled = true;
+      }
     }
-    DCHECK_GE(frame.stream_id, next_stream_id);
-    size_t index = (frame.stream_id - next_stream_id) /
-                   QuicUtils::StreamIdDelta(transport_version());
-    DCHECK_LE(index, promised_streams_.size());
-    promised_streams_[index].is_cancelled = true;
     control_frame_manager().WriteOrBufferRstStream(frame.stream_id,
                                                    QUIC_RST_ACKNOWLEDGEMENT, 0);
     connection()->OnStreamReset(frame.stream_id, QUIC_RST_ACKNOWLEDGEMENT);