QPID-3033: Segmentation fault while processing session.attach

The initial fix for this bug was incomplete.

The original bug was triggered by a faulty client sending
session.attach before connection.open.  The special case is when the
session.attach is on channel 0. This commit fixes the broker for all
cases where a faulty client sends frames before completly opening the
connection.

Older versions of the Java client are known to send this faulty sequence sporadically,
see https://issues.apache.org/jira/browse/QPID-3042.

git-svn-id: https://svn.apache.org/repos/asf/qpid/trunk/qpid@1159329 13f79535-47bb-0310-9956-ffa450edef68

1 files changed, 8 insertions, 1 deletions

diff --git a/cpp/src/qpid/broker/ConnectionHandler.cpp b/cpp/src/qpid/broker/ConnectionHandler.cpp
index 270711705e..948aa04417 100644
--- a/cpp/src/qpid/broker/ConnectionHandler.cpp
+++ b/cpp/src/qpid/broker/ConnectionHandler.cpp
@@ -68,8 +68,15 @@ void ConnectionHandler::handle(framing::AMQFrame& frame)
     AMQMethodBody* method=frame.getBody()->getMethod();
     Connection::ErrorListener* errorListener = handler->connection.getErrorListener();
     try{
-        if (!invoke(static_cast<AMQP_AllOperations::ConnectionHandler&>(*handler.get()), *method)) {
+        if (method && invoke(
+                static_cast<AMQP_AllOperations::ConnectionHandler&>(*handler), *method)) {
+            // This is a connection control frame, nothing more to do.
+        } else if (isOpen()) {
             handler->connection.getChannel(frame.getChannel()).in(frame);
+        } else {
+            handler->proxy.close(
+                connection::CLOSE_CODE_FRAMING_ERROR,
+                "Connection not yet open, invalid frame received.");
         }
     }catch(ConnectionException& e){
         if (errorListener) errorListener->connectionError(e.what());