reject STREAM frames that would close the crypto stream

session.go

@@ -563,6 +563,9 @@ func (s *session) handlePacket(p *receivedPacket) {
 
 func (s *session) handleStreamFrame(frame *wire.StreamFrame) error {
 	if frame.StreamID == s.version.CryptoStreamID() {
+		if frame.FinBit {
+			return errors.New("Received STREAM frame with FIN bit for the crypto stream")
+		}
 		return s.cryptoStream.AddStreamFrame(frame)
 	}
 	str, err := s.streamsMap.GetOrOpenStream(frame.StreamID)

session_test.go

@@ -269,7 +269,7 @@ var _ = Describe("Session", func() {
 			}
 		})
 
-		Context("when handling STREAM frames", func() {
+		Context("handling STREAM frames", func() {
 			BeforeEach(func() {
 				sess.streamsMap.UpdateMaxStreamLimit(100)
 			})
@@ -330,6 +330,15 @@ var _ = Describe("Session", func() {
 				})
 				Expect(err).ToNot(HaveOccurred())
 			})
+
+			It("errors on a STREAM frame that would close the crypto stream", func() {
+				err := sess.handleStreamFrame(&wire.StreamFrame{
+					StreamID: sess.version.CryptoStreamID(),
+					Offset:   0x1337,
+					FinBit:   true,
+				})
+				Expect(err).To(MatchError("Received STREAM frame with FIN bit for the crypto stream"))
+			})
 		})
 
 		Context("handling RST_STREAM frames", func() {