From 7323d4c639d703767c092301cf75f5489e0b191b Mon Sep 17 00:00:00 2001
From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
Date: Fri, 17 Apr 2015 00:12:47 +0900
Subject: [PATCH] Fix bug that nghttp2_session_set_next_stream_id accepts
 invalid stream_id

---
 lib/includes/nghttp2/nghttp2.h |  4 +++-
 lib/nghttp2_session.c          | 10 +++++++++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/lib/includes/nghttp2/nghttp2.h b/lib/includes/nghttp2/nghttp2.h
index 7d75f606..6f601244 100644
--- a/lib/includes/nghttp2/nghttp2.h
+++ b/lib/includes/nghttp2/nghttp2.h
@@ -2707,7 +2707,9 @@ NGHTTP2_EXTERN uint32_t
  *
  * :enum:`NGHTTP2_ERR_INVALID_ARGUMENT`
  *     The |next_stream_id| is strictly less than the value
- *     `nghttp2_session_get_next_stream_id()` returns.
+ *     `nghttp2_session_get_next_stream_id()` returns; or
+ *     |next_stream_id| is invalid (e.g., even integer for client, or
+ *     odd integer for server).
  */
 NGHTTP2_EXTERN int nghttp2_session_set_next_stream_id(nghttp2_session *session,
                                                       int32_t next_stream_id);
diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c
index 9992c45a..6bec4ea8 100644
--- a/lib/nghttp2_session.c
+++ b/lib/nghttp2_session.c
@@ -6622,11 +6622,19 @@ int nghttp2_session_consume_stream(nghttp2_session *session, int32_t stream_id,
 
 int nghttp2_session_set_next_stream_id(nghttp2_session *session,
                                        int32_t next_stream_id) {
-  if (next_stream_id < 0 ||
+  if (next_stream_id <= 0 ||
       session->next_stream_id > (uint32_t)next_stream_id) {
     return NGHTTP2_ERR_INVALID_ARGUMENT;
   }
 
+  if (session->server) {
+    if (next_stream_id % 2) {
+      return NGHTTP2_ERR_INVALID_ARGUMENT;
+    }
+  } else if (next_stream_id % 2 == 0) {
+    return NGHTTP2_ERR_INVALID_ARGUMENT;
+  }
+
   session->next_stream_id = next_stream_id;
   return 0;
 }