Merge github.com:grpc/grpc into we-dont-need-no-backup

Conflicts:
	test/core/bad_client/bad_client.c
	test/core/httpcli/httpcli_test.c

1 files changed, 10 insertions, 1 deletions

diff --git a/src/core/transport/chttp2_transport.c b/src/core/transport/chttp2_transport.c
index d9c712cc63..c4c5a392b3 100644
--- a/src/core/transport/chttp2_transport.c
+++ b/src/core/transport/chttp2_transport.c
@@ -1588,12 +1588,21 @@ static int init_goaway_parser(transport *t) {
 }
 
 static int init_settings_frame_parser(transport *t) {
-  int ok = GRPC_CHTTP2_PARSE_OK ==
+  int ok;
+
+  if (t->incoming_stream_id != 0) {
+    gpr_log(GPR_ERROR, "settings frame received for stream %d", t->incoming_stream_id);
+    drop_connection(t);
+    return 0;
+  }
+
+  ok = GRPC_CHTTP2_PARSE_OK ==
            grpc_chttp2_settings_parser_begin_frame(
                &t->simple_parsers.settings, t->incoming_frame_size,
                t->incoming_frame_flags, t->settings[PEER_SETTINGS]);
   if (!ok) {
     drop_connection(t);
+    return 0;
   }
   if (t->incoming_frame_flags & GRPC_CHTTP2_FLAG_ACK) {
     memcpy(t->settings[ACKED_SETTINGS], t->settings[SENT_SETTINGS],