wire: reject NEW_CONNECTION_ID frames with zero-length conneciton IDs (#4180)

internal/wire/new_connection_id_frame.go

@@ -2,6 +2,7 @@ package wire
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"io"
 
@@ -34,6 +35,9 @@ func parseNewConnectionIDFrame(r *bytes.Reader, _ protocol.VersionNumber) (*NewC
 	if err != nil {
 		return nil, err
 	}
+	if connIDLen == 0 {
+		return nil, errors.New("invalid zero-length connection ID")
+	}
 	connID, err := protocol.ReadConnectionID(r, int(connIDLen))
 	if err != nil {
 		return nil, err