2 files changed, 30 insertions, 0 deletions
diff --git a/net/spdy/spdy_framer.cc b/net/spdy/spdy_framer.cc
index 83652d3..9aea310 100644
--- a/net/spdy/spdy_framer.cc
+++ b/net/spdy/spdy_framer.cc
@@ -477,6 +477,8 @@ bool SpdyFramer::ParseHeaderBlock(const SpdyFrame* frame,
         break;
       if (!builder.ReadString(&iter, &value))
         break;
+      if (!name.size() || !value.size())
+        return false;
       if (block->find(name) == block->end()) {
         (*block)[name] = value;
       } else {
diff --git a/net/spdy/spdy_framer_test.cc b/net/spdy/spdy_framer_test.cc
index 783c4ac..6192b40 100644
--- a/net/spdy/spdy_framer_test.cc
+++ b/net/spdy/spdy_framer_test.cc
@@ -234,6 +234,34 @@ TEST_F(SpdyFramerTest, MultiValueHeader) {
   EXPECT_EQ(value, new_headers.find("name")->second);
 }
 
+TEST_F(SpdyFramerTest, ZeroLengthHeader) {
+  SpdyHeaderBlock header1;
+  SpdyHeaderBlock header2;
+  SpdyHeaderBlock header3;
+
+  header1[""] = "value2";
+  header2["name3"] = "";
+  header3[""] = "";
+
+  SpdyFramer framer;
+  SpdyHeaderBlock parsed_headers;
+
+  scoped_ptr<SpdySynStreamControlFrame> frame1(
+      framer.CreateSynStream(1, 0, 1, CONTROL_FLAG_NONE, true, &header1));
+  EXPECT_TRUE(frame1.get() != NULL);
+  EXPECT_FALSE(framer.ParseHeaderBlock(frame1.get(), &parsed_headers));
+
+  scoped_ptr<SpdySynStreamControlFrame> frame2(
+      framer.CreateSynStream(1, 0, 1, CONTROL_FLAG_NONE, true, &header2));
+  EXPECT_TRUE(frame2.get() != NULL);
+  EXPECT_FALSE(framer.ParseHeaderBlock(frame2.get(), &parsed_headers));
+
+  scoped_ptr<SpdySynStreamControlFrame> frame3(
+      framer.CreateSynStream(1, 0, 1, CONTROL_FLAG_NONE, true, &header3));
+  EXPECT_TRUE(frame3.get() != NULL);
+  EXPECT_FALSE(framer.ParseHeaderBlock(frame3.get(), &parsed_headers));
+}
+
 TEST_F(SpdyFramerTest, BasicCompression) {
   SpdyHeaderBlock headers;
   headers["server"] = "SpdyServer 1.0";