commit a745e39b671f22a92dff3fc918617fbfaf60ed1e
author nharper <nharper@google.com> Fri Apr 19 12:05:15 2019 -0700
committer Copybara-Service <copybara-worker@google.com> Mon Apr 22 08:40:52 2019 -0700
tree d31ce67e6781798b7680d4ef0453e70d9ca5bc36
parent 2ceb97cd7a50342618eee63f76eb997b6ad47ce5

Check that the expected and actual public header types match

If a V99 server receives a packet with Google QUIC header and no version
prior to version negotiation completing, it would QUIC_BUG. Now it will
gracefully handle the garbage packet.

gfe-relnote: Protected behind QUIC_VERSION_99 and quic_supports_tls_handshake
PiperOrigin-RevId: 244398840
Change-Id: I59e58ea4254edc04087e0088c7c62fe46340421a

quic/core/quic_framer.cc

diff --git a/quic/core/quic_framer.cc b/quic/core/quic_framer.cc
index cc10cca..fcb85da 100644
--- a/quic/core/quic_framer.cc
+++ b/quic/core/quic_framer.cc
@@ -2465,6 +2465,10 @@
         "Visitor asked to stop processing of unauthenticated header.");
     return false;
   }
+  if (!header->version_flag && version().KnowsWhichDecrypterToUse()) {
+    set_detailed_error("Invalid public header type for expected version.");
+    return RaiseError(QUIC_INVALID_PACKET_HEADER);
+  }
   return true;
 }