From d75ba74bbd450e30f953c3e56efdfe0bad198d38 Mon Sep 17 00:00:00 2001
From: Tatsuhiro Tsujikawa <tatsuhiro.t@gmail.com>
Date: Sat, 29 Nov 2014 16:17:02 +0900
Subject: [PATCH] Return error if invalid stream_id is given to
 nghttp2_submit_push_promise

---
 lib/includes/nghttp2/nghttp2.h | 3 ++-
 lib/nghttp2_session.c          | 5 -----
 lib/nghttp2_submit.c           | 2 +-
 tests/nghttp2_session_test.c   | 4 +++-
 4 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/lib/includes/nghttp2/nghttp2.h b/lib/includes/nghttp2/nghttp2.h
index 2fe80891..b136cbdd 100644
--- a/lib/includes/nghttp2/nghttp2.h
+++ b/lib/includes/nghttp2/nghttp2.h
@@ -2802,7 +2802,8 @@ int nghttp2_submit_settings(nghttp2_session *session, uint8_t flags,
  *     No stream ID is available because maximum stream ID was
  *     reached.
  * :enum:`NGHTTP2_ERR_INVALID_ARGUMENT`
- *     The |stream_id| is 0.
+ *     The |stream_id| is 0; The |stream_id| does not designate stream
+ *     that peer initiated.
  *
  * .. warning::
  *
diff --git a/lib/nghttp2_session.c b/lib/nghttp2_session.c
index ac5537a2..1f9ad5b9 100644
--- a/lib/nghttp2_session.c
+++ b/lib/nghttp2_session.c
@@ -1358,11 +1358,6 @@ static int session_predicate_push_promise_send(nghttp2_session *session,
 
   assert(stream);
 
-  if (nghttp2_session_is_my_stream_id(session, stream->stream_id)) {
-    /* The associated stream must be initiated by the remote peer */
-    return NGHTTP2_ERR_PROTO;
-  }
-
   if (session->remote_settings.enable_push == 0) {
     return NGHTTP2_ERR_PUSH_DISABLED;
   }
diff --git a/lib/nghttp2_submit.c b/lib/nghttp2_submit.c
index f15d5681..b658d382 100644
--- a/lib/nghttp2_submit.c
+++ b/lib/nghttp2_submit.c
@@ -247,7 +247,7 @@ int32_t nghttp2_submit_push_promise(nghttp2_session *session, uint8_t flags _U_,
   int32_t promised_stream_id;
   int rv;
 
-  if (stream_id == 0) {
+  if (stream_id == 0 || nghttp2_session_is_my_stream_id(session, stream_id)) {
     return NGHTTP2_ERR_INVALID_ARGUMENT;
   }
 
diff --git a/tests/nghttp2_session_test.c b/tests/nghttp2_session_test.c
index 670a0694..3c902c95 100644
--- a/tests/nghttp2_session_test.c
+++ b/tests/nghttp2_session_test.c
@@ -4146,7 +4146,9 @@ void test_nghttp2_submit_invalid_nv(void) {
                                        NULL));
 
   /* nghttp2_submit_push_promise */
-  CU_ASSERT(0 < nghttp2_submit_push_promise(session, NGHTTP2_FLAG_NONE, 2,
+  open_stream(session, 1);
+
+  CU_ASSERT(0 < nghttp2_submit_push_promise(session, NGHTTP2_FLAG_NONE, 1,
                                             empty_name_nv,
                                             ARRLEN(empty_name_nv), NULL));