Update manual pages

CMakeLists.txt

@@ -24,12 +24,12 @@
 
 cmake_minimum_required(VERSION 3.14)
 # XXX using 1.8.90 instead of 1.9.0-DEV
-project(nghttp2 VERSION 1.68.0 LANGUAGES C)
+project(nghttp2 VERSION 1.68.1 LANGUAGES C)
 
 # See versioning rule:
 #  https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
 set(LT_CURRENT  43)
-set(LT_REVISION 2)
+set(LT_REVISION 3)
 set(LT_AGE      29)
 
 set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake" ${CMAKE_MODULE_PATH})

configure.ac

@@ -25,7 +25,7 @@ dnl Do not change user variables!
 dnl https://www.gnu.org/software/automake/manual/html_node/Flag-Variables-Ordering.html
 
 AC_PREREQ(2.61)
-AC_INIT([nghttp2], [1.68.0], [t-tujikawa@users.sourceforge.net])
+AC_INIT([nghttp2], [1.68.1], [t-tujikawa@users.sourceforge.net])
 AC_CONFIG_AUX_DIR([.])
 AC_CONFIG_MACRO_DIR([m4])
 AC_CONFIG_HEADERS([config.h])
@@ -45,7 +45,7 @@ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES([yes])])
 dnl See versioning rule:
 dnl  https://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
 AC_SUBST(LT_CURRENT, 43)
-AC_SUBST(LT_REVISION, 2)
+AC_SUBST(LT_REVISION, 3)
 AC_SUBST(LT_AGE, 29)
 
 major=`echo $PACKAGE_VERSION |cut -d. -f1 | sed -e "s/[^0-9]//g"`

doc/h2load.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "H2LOAD" "1" "Oct 25, 2025" "1.68.0" "nghttp2"
+.TH "H2LOAD" "1" "Mar 18, 2026" "1.68.1" "nghttp2"
 .SH NAME
 h2load \- HTTP/2 benchmarking tool
 .SH SYNOPSIS

doc/nghttp.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "NGHTTP" "1" "Oct 25, 2025" "1.68.0" "nghttp2"
+.TH "NGHTTP" "1" "Mar 18, 2026" "1.68.1" "nghttp2"
 .SH NAME
 nghttp \- HTTP/2 client
 .SH SYNOPSIS

doc/nghttpd.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "NGHTTPD" "1" "Oct 25, 2025" "1.68.0" "nghttp2"
+.TH "NGHTTPD" "1" "Mar 18, 2026" "1.68.1" "nghttp2"
 .SH NAME
 nghttpd \- HTTP/2 server
 .SH SYNOPSIS

doc/nghttpx.1

@@ -27,7 +27,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
 ..
-.TH "NGHTTPX" "1" "Oct 25, 2025" "1.68.0" "nghttp2"
+.TH "NGHTTPX" "1" "Mar 18, 2026" "1.68.1" "nghttp2"
 .SH NAME
 nghttpx \- HTTP/2 proxy
 .SH SYNOPSIS

lib/nghttp2_frame.c

@@ -750,6 +750,16 @@ void nghttp2_frame_unpack_altsvc_payload(nghttp2_extension *frame,
   uint8_t *p;
 
   altsvc = frame->payload;
+
+  if (payloadlen == 0) {
+    altsvc->origin = NULL;
+    altsvc->origin_len = 0;
+    altsvc->field_value = NULL;
+    altsvc->field_value_len = 0;
+
+    return;
+  }
+
   p = payload;
 
   altsvc->origin = p;

lib/nghttp2_session.c

@@ -5466,6 +5466,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         busy = 1;
 
         rv = session_on_data_received_fail_fast(session);
+        if (nghttp2_is_fatal(rv)) {
+          return rv;
+        }
+
         if (iframe->state == NGHTTP2_IB_IGN_ALL) {
           return (nghttp2_ssize)inlen;
         }
@@ -5486,10 +5490,6 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
           break;
         }
 
-        if (nghttp2_is_fatal(rv)) {
-          return rv;
-        }
-
         rv = inbound_frame_handle_pad(iframe, &iframe->frame.hd);
         if (rv < 0) {
           rv = nghttp2_session_terminate_session_with_reason(
@@ -5573,6 +5573,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
           return rv;
         }
 
+        if (iframe->state == NGHTTP2_IB_IGN_ALL) {
+          return (nghttp2_ssize)inlen;
+        }
+
         on_begin_frame_called = 1;
 
         rv = session_process_headers_frame(session);
@@ -6041,6 +6045,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
           if (nghttp2_is_fatal(rv)) {
             return rv;
           }
+
+          if (iframe->state == NGHTTP2_IB_IGN_ALL) {
+            return (nghttp2_ssize)inlen;
+          }
         }
       }
 
@@ -6293,6 +6301,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
           return rv;
         }
 
+        if (iframe->state == NGHTTP2_IB_IGN_ALL) {
+          return (nghttp2_ssize)inlen;
+        }
+
         session_inbound_frame_reset(session);
 
         break;
@@ -6599,6 +6611,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         if (nghttp2_is_fatal(rv)) {
           return rv;
         }
+
+        if (iframe->state == NGHTTP2_IB_IGN_ALL) {
+          return (nghttp2_ssize)inlen;
+        }
       } else {
         iframe->state = NGHTTP2_IB_IGN_HEADER_BLOCK;
       }
@@ -6771,13 +6787,17 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
             rv = session->callbacks.on_data_chunk_recv_callback(
               session, iframe->frame.hd.flags, iframe->frame.hd.stream_id,
               in - readlen, (size_t)data_readlen, session->user_data);
-            if (rv == NGHTTP2_ERR_PAUSE) {
-              return (nghttp2_ssize)(in - first);
-            }
-
             if (nghttp2_is_fatal(rv)) {
               return NGHTTP2_ERR_CALLBACK_FAILURE;
             }
+
+            if (iframe->state == NGHTTP2_IB_IGN_ALL) {
+              return (nghttp2_ssize)inlen;
+            }
+
+            if (rv == NGHTTP2_ERR_PAUSE) {
+              return (nghttp2_ssize)(in - first);
+            }
           }
         }
       }
@@ -6861,6 +6881,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
           return rv;
         }
 
+        if (iframe->state == NGHTTP2_IB_IGN_ALL) {
+          return (nghttp2_ssize)inlen;
+        }
+
         if (rv != 0) {
           busy = 1;
 
@@ -6879,6 +6903,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         return rv;
       }
 
+      if (iframe->state == NGHTTP2_IB_IGN_ALL) {
+        return (nghttp2_ssize)inlen;
+      }
+
       session_inbound_frame_reset(session);
 
       break;
@@ -6907,6 +6935,10 @@ nghttp2_ssize nghttp2_session_mem_recv2(nghttp2_session *session,
         return rv;
       }
 
+      if (iframe->state == NGHTTP2_IB_IGN_ALL) {
+        return (nghttp2_ssize)inlen;
+      }
+
       session_inbound_frame_reset(session);
 
       break;

tests/nghttp2_frame_test.c

@@ -515,6 +515,24 @@ void test_nghttp2_frame_pack_altsvc(void) {
 
   nghttp2_frame_altsvc_free(&oframe, mem);
   nghttp2_frame_altsvc_free(&frame, mem);
+
+  /* 0 length origin and field_value */
+  nghttp2_frame_altsvc_init(&frame, 0, NULL, 0, NULL, 0);
+
+  payloadlen = 2;
+
+  nghttp2_bufs_reset(&bufs);
+  nghttp2_frame_pack_altsvc(&bufs, &frame);
+
+  assert_size(NGHTTP2_FRAME_HDLEN + payloadlen, ==, nghttp2_bufs_len(&bufs));
+
+  nghttp2_frame_unpack_altsvc_payload(&oframe, 0, NULL, 0);
+
+  assert_size(0, ==, oaltsvc.origin_len);
+  assert_null(oaltsvc.origin);
+  assert_size(0, ==, oaltsvc.field_value_len);
+  assert_null(oaltsvc.field_value);
+
   nghttp2_bufs_free(&bufs);
 }
 

tests/nghttp2_session_test.c

@@ -157,6 +157,7 @@ static const MunitTest tests[] = {
   munit_void_test(test_nghttp2_session_set_stream_user_data),
   munit_void_test(test_nghttp2_session_no_rfc7540_priorities),
   munit_void_test(test_nghttp2_session_stream_reset_ratelim),
+  munit_void_test(test_nghttp2_session_verify_iframe_state),
   munit_void_test(test_nghttp2_http_mandatory_headers),
   munit_void_test(test_nghttp2_http_content_length),
   munit_void_test(test_nghttp2_http_content_length_mismatch),
@@ -10160,6 +10161,443 @@ void test_nghttp2_session_stream_reset_ratelim(void) {
   nghttp2_option_del(option);
 }
 
+static int term_session_on_invalid_frame_recv_callback(
+  nghttp2_session *session, const nghttp2_frame *frame, int lib_error_code,
+  void *user_data) {
+  int rv;
+  (void)frame;
+  (void)lib_error_code;
+  (void)user_data;
+
+  rv = nghttp2_session_terminate_session(session, NGHTTP2_NO_ERROR);
+
+  assert_int(0, ==, rv);
+
+  return 0;
+}
+
+static int term_session_on_begin_frame_callback(nghttp2_session *session,
+                                                const nghttp2_frame_hd *hd,
+                                                void *user_data) {
+  int rv;
+  (void)hd;
+  (void)user_data;
+
+  rv = nghttp2_session_terminate_session(session, NGHTTP2_NO_ERROR);
+
+  assert_int(0, ==, rv);
+
+  return 0;
+}
+
+static int term_session_on_frame_recv_callback(nghttp2_session *session,
+                                               const nghttp2_frame *frame,
+                                               void *user_data) {
+  int rv;
+  (void)frame;
+  (void)user_data;
+
+  rv = nghttp2_session_terminate_session(session, NGHTTP2_NO_ERROR);
+
+  assert_int(0, ==, rv);
+
+  return 0;
+}
+
+static int term_session_on_data_chunk_recv_callback(
+  nghttp2_session *session, uint8_t flags, int32_t stream_id,
+  const uint8_t *data, size_t len, void *user_data) {
+  int rv;
+  (void)flags;
+  (void)stream_id;
+  (void)data;
+  (void)len;
+  (void)user_data;
+
+  rv = nghttp2_session_terminate_session(session, NGHTTP2_NO_ERROR);
+
+  assert_int(0, ==, rv);
+
+  return 0;
+}
+
+static int term_session_unpack_extension_callback(nghttp2_session *session,
+                                                  void **payload,
+                                                  const nghttp2_frame_hd *hd,
+                                                  void *user_data) {
+  int rv;
+  (void)payload;
+  (void)hd;
+  (void)user_data;
+
+  rv = nghttp2_session_terminate_session(session, NGHTTP2_NO_ERROR);
+
+  assert_int(0, ==, rv);
+
+  return 0;
+}
+
+static int term_session_on_extension_chunk_recv_callback(
+  nghttp2_session *session, const nghttp2_frame_hd *hd, const uint8_t *data,
+  size_t len, void *user_data) {
+  int rv;
+  (void)hd;
+  (void)data;
+  (void)len;
+  (void)user_data;
+
+  rv = nghttp2_session_terminate_session(session, NGHTTP2_NO_ERROR);
+
+  assert_int(0, ==, rv);
+
+  return NGHTTP2_ERR_CANCEL;
+}
+
+void test_nghttp2_session_verify_iframe_state(void) {
+  nghttp2_session *session;
+  nghttp2_session_callbacks callbacks;
+  nghttp2_bufs bufs;
+  nghttp2_buf *buf;
+  nghttp2_frame frame;
+  nghttp2_extension extfr;
+  nghttp2_ext_priority_update priority_update;
+  nghttp2_ext_altsvc altsvc;
+  nghttp2_frame_hd hd;
+  uint8_t size_err_hd[NGHTTP2_FRAME_HDLEN];
+  nghttp2_ssize rv;
+  const char field_value[] = "i";
+  nghttp2_option *option;
+  nghttp2_hd_deflater deflater;
+  size_t nvlen;
+  nghttp2_nv *nva;
+  nghttp2_mem *mem = nghttp2_mem_default();
+  my_user_data ud;
+  nghttp2_buf udbuf;
+  const char uddata[] = "hello world";
+
+  nghttp2_frame_hd_init(&hd, 0, NGHTTP2_RST_STREAM, NGHTTP2_FLAG_NONE, 1);
+  nghttp2_frame_pack_frame_hd(size_err_hd, &hd);
+
+  nghttp2_buf_init2(&ud.scratchbuf, 4096, mem);
+  nghttp2_buf_init2(&udbuf, 4096, mem);
+
+  nghttp2_frame_hd_init(&hd, sizeof(uddata) - 1, 111, 0xab, 1000000007);
+  nghttp2_frame_pack_frame_hd(udbuf.last, &hd);
+  udbuf.last += NGHTTP2_FRAME_HDLEN;
+  udbuf.last = nghttp2_cpymem(udbuf.last, uddata, sizeof(uddata) - 1);
+
+  nghttp2_option_new(&option);
+  nghttp2_option_set_builtin_recv_extension_type(option,
+                                                 NGHTTP2_PRIORITY_UPDATE);
+  nghttp2_option_set_builtin_recv_extension_type(option, NGHTTP2_ALTSVC);
+  nghttp2_option_set_user_recv_extension_type(option, 111);
+
+  frame_pack_bufs_init(&bufs);
+
+  /* ALTSVC + on_invalid_frame_recv_callback + FRAME_SIZE_ERROR */
+  memset(&callbacks, 0, sizeof(callbacks));
+  callbacks.on_invalid_frame_recv_callback =
+    term_session_on_invalid_frame_recv_callback;
+
+  nghttp2_session_client_new2(&session, &callbacks, NULL, option);
+
+  extfr.payload = &altsvc;
+  nghttp2_frame_altsvc_init(&extfr, 0, NULL, 0, NULL, 0);
+  nghttp2_bufs_reset(&bufs);
+  nghttp2_frame_pack_altsvc(&bufs, &extfr);
+
+  buf = &bufs.head->buf;
+
+  rv = nghttp2_session_mem_recv2(session, buf->pos, nghttp2_bufs_len(&bufs));
+
+  assert_ptrdiff((nghttp2_ssize)nghttp2_bufs_len(&bufs), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  rv = nghttp2_session_mem_recv2(session, size_err_hd, sizeof(size_err_hd));
+
+  assert_ptrdiff((nghttp2_ssize)sizeof(size_err_hd), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  nghttp2_session_del(session);
+
+  /* HEADERS + on_begin_frame_callback + FRAME_SIZE_ERROR */
+  memset(&callbacks, 0, sizeof(callbacks));
+  callbacks.on_begin_frame_callback = term_session_on_begin_frame_callback;
+
+  nghttp2_session_server_new(&session, &callbacks, NULL);
+
+  nvlen = ARRLEN(reqnv);
+  nghttp2_nv_array_copy(&nva, reqnv, nvlen, mem);
+  nghttp2_frame_headers_init(&frame.headers, NGHTTP2_FLAG_END_HEADERS, 1,
+                             NGHTTP2_HCAT_HEADERS, NULL, nva, nvlen);
+  nghttp2_hd_deflate_init(&deflater, mem);
+  nghttp2_bufs_reset(&bufs);
+  rv = nghttp2_frame_pack_headers(&bufs, &frame.headers, &deflater);
+
+  assert_ptrdiff(0, ==, rv);
+
+  nghttp2_frame_headers_free(&frame.headers, mem);
+
+  buf = &bufs.head->buf;
+
+  rv = nghttp2_session_mem_recv2(session, buf->pos, nghttp2_bufs_len(&bufs));
+
+  assert_ptrdiff((nghttp2_ssize)nghttp2_bufs_len(&bufs), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  rv = nghttp2_session_mem_recv2(session, size_err_hd, sizeof(size_err_hd));
+
+  assert_ptrdiff((nghttp2_ssize)sizeof(size_err_hd), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  nghttp2_hd_deflate_free(&deflater);
+  nghttp2_session_del(session);
+
+  /* Any frame (other than HEADERS) + on_begin_frame_callback +
+     FRAME_SIZE_ERROR */
+  memset(&callbacks, 0, sizeof(callbacks));
+  callbacks.on_begin_frame_callback = term_session_on_begin_frame_callback;
+
+  nghttp2_session_server_new(&session, &callbacks, NULL);
+
+  nghttp2_frame_rst_stream_init(&frame.rst_stream, 1, NGHTTP2_NO_ERROR);
+  nghttp2_bufs_reset(&bufs);
+  nghttp2_frame_pack_rst_stream(&bufs, &frame.rst_stream);
+
+  buf = &bufs.head->buf;
+
+  rv = nghttp2_session_mem_recv2(session, buf->pos, nghttp2_bufs_len(&bufs));
+
+  assert_ptrdiff((nghttp2_ssize)nghttp2_bufs_len(&bufs), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  rv = nghttp2_session_mem_recv2(session, size_err_hd, sizeof(size_err_hd));
+
+  assert_ptrdiff((nghttp2_ssize)sizeof(size_err_hd), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  nghttp2_session_del(session);
+
+  /* PRIORITY_UPDATE + on_frame_recv_callback + FRAME_SIZE_ERROR */
+  memset(&callbacks, 0, sizeof(callbacks));
+  callbacks.on_frame_recv_callback = term_session_on_frame_recv_callback;
+
+  nghttp2_session_server_new2(&session, &callbacks, NULL, option);
+
+  extfr.payload = &priority_update;
+  nghttp2_frame_priority_update_init(&extfr, 1, (uint8_t *)field_value,
+                                     sizeof(field_value) - 1);
+  nghttp2_bufs_reset(&bufs);
+  nghttp2_frame_pack_priority_update(&bufs, &extfr);
+
+  buf = &bufs.head->buf;
+
+  rv = nghttp2_session_mem_recv2(session, buf->pos, nghttp2_bufs_len(&bufs));
+
+  assert_ptrdiff((nghttp2_ssize)nghttp2_bufs_len(&bufs), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  rv = nghttp2_session_mem_recv2(session, size_err_hd, sizeof(size_err_hd));
+
+  assert_ptrdiff((nghttp2_ssize)sizeof(size_err_hd), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  nghttp2_session_del(session);
+
+  /* ALTSVC + on_frame_recv_callback + FRAME_SIZE_ERROR */
+  memset(&callbacks, 0, sizeof(callbacks));
+  callbacks.on_frame_recv_callback = term_session_on_frame_recv_callback;
+
+  nghttp2_session_client_new2(&session, &callbacks, NULL, option);
+
+  extfr.payload = &altsvc;
+  nghttp2_frame_altsvc_init(&extfr, 0, (uint8_t *)"nghttp2.org",
+                            sizeof("nghttp2.org") - 1, (uint8_t *)"h2",
+                            sizeof("h2") - 1);
+  nghttp2_bufs_reset(&bufs);
+  nghttp2_frame_pack_altsvc(&bufs, &extfr);
+
+  buf = &bufs.head->buf;
+
+  rv = nghttp2_session_mem_recv2(session, buf->pos, nghttp2_bufs_len(&bufs));
+
+  assert_ptrdiff((nghttp2_ssize)nghttp2_bufs_len(&bufs), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  rv = nghttp2_session_mem_recv2(session, size_err_hd, sizeof(size_err_hd));
+
+  assert_ptrdiff((nghttp2_ssize)sizeof(size_err_hd), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  nghttp2_session_del(session);
+
+  /* user-defined extension frame + on_frame_recv_callback +
+     FRAME_SIZE_ERROR */
+  memset(&callbacks, 0, sizeof(callbacks));
+  callbacks.on_frame_recv_callback = term_session_on_frame_recv_callback;
+  callbacks.unpack_extension_callback = unpack_extension_callback;
+
+  nghttp2_session_server_new2(&session, &callbacks, &ud, option);
+
+  nghttp2_buf_reset(&ud.scratchbuf);
+
+  rv = nghttp2_session_mem_recv2(session, udbuf.pos, nghttp2_buf_len(&udbuf));
+
+  assert_ptrdiff((nghttp2_ssize)nghttp2_buf_len(&udbuf), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  rv = nghttp2_session_mem_recv2(session, size_err_hd, sizeof(size_err_hd));
+
+  assert_ptrdiff((nghttp2_ssize)sizeof(size_err_hd), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  nghttp2_session_del(session);
+
+  /* DATA + on_data_chunk_recv_callback + FRAME_SIZE_ERROR*/
+  memset(&callbacks, 0, sizeof(callbacks));
+  callbacks.on_data_chunk_recv_callback =
+    term_session_on_data_chunk_recv_callback;
+
+  nghttp2_session_server_new(&session, &callbacks, NULL);
+
+  nvlen = ARRLEN(reqnv);
+  nghttp2_nv_array_copy(&nva, reqnv, nvlen, mem);
+  nghttp2_frame_headers_init(&frame.headers, NGHTTP2_FLAG_END_HEADERS, 1,
+                             NGHTTP2_HCAT_HEADERS, NULL, nva, nvlen);
+  nghttp2_hd_deflate_init(&deflater, mem);
+  nghttp2_bufs_reset(&bufs);
+  rv = nghttp2_frame_pack_headers(&bufs, &frame.headers, &deflater);
+
+  assert_ptrdiff(0, ==, rv);
+
+  nghttp2_frame_headers_free(&frame.headers, mem);
+
+  buf = &bufs.head->buf;
+
+  rv = nghttp2_session_mem_recv2(session, buf->pos, nghttp2_bufs_len(&bufs));
+
+  assert_ptrdiff((nghttp2_ssize)nghttp2_bufs_len(&bufs), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_READ_HEAD, ==,
+              session->iframe.state);
+
+  nghttp2_frame_hd_init(&hd, 10, NGHTTP2_DATA, NGHTTP2_FLAG_NONE, 1);
+  nghttp2_bufs_reset(&bufs);
+  nghttp2_frame_pack_frame_hd(bufs.head->buf.last, &hd);
+  bufs.head->buf.last += NGHTTP2_FRAME_HDLEN;
+  memset(bufs.head->buf.last, 0, 10);
+  bufs.head->buf.last += 10;
+
+  buf = &bufs.head->buf;
+
+  rv = nghttp2_session_mem_recv2(session, buf->pos, nghttp2_bufs_len(&bufs));
+
+  assert_ptrdiff((nghttp2_ssize)nghttp2_bufs_len(&bufs), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  rv = nghttp2_session_mem_recv2(session, size_err_hd, sizeof(size_err_hd));
+
+  assert_ptrdiff((nghttp2_ssize)sizeof(size_err_hd), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  nghttp2_hd_deflate_free(&deflater);
+  nghttp2_session_del(session);
+
+  /* user-defined extension frame + on_extension_chunk_recv_callback +
+     FRAME_SIZE_ERROR */
+  memset(&callbacks, 0, sizeof(callbacks));
+  callbacks.on_extension_chunk_recv_callback =
+    term_session_on_extension_chunk_recv_callback;
+  callbacks.unpack_extension_callback = unpack_extension_callback;
+
+  nghttp2_session_server_new2(&session, &callbacks, &ud, option);
+
+  nghttp2_buf_reset(&ud.scratchbuf);
+
+  rv = nghttp2_session_mem_recv2(session, udbuf.pos, nghttp2_buf_len(&udbuf));
+
+  assert_ptrdiff((nghttp2_ssize)nghttp2_buf_len(&udbuf), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  rv = nghttp2_session_mem_recv2(session, size_err_hd, sizeof(size_err_hd));
+
+  assert_ptrdiff((nghttp2_ssize)sizeof(size_err_hd), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  nghttp2_session_del(session);
+
+  /* user-defined extension frame + unpack_extension_callback +
+     FRAME_SIZE_ERROR */
+  memset(&callbacks, 0, sizeof(callbacks));
+  callbacks.unpack_extension_callback = term_session_unpack_extension_callback;
+
+  nghttp2_session_server_new2(&session, &callbacks, &ud, option);
+
+  nghttp2_buf_reset(&ud.scratchbuf);
+
+  rv = nghttp2_session_mem_recv2(session, udbuf.pos, nghttp2_buf_len(&udbuf));
+
+  assert_ptrdiff((nghttp2_ssize)nghttp2_buf_len(&udbuf), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  rv = nghttp2_session_mem_recv2(session, size_err_hd, sizeof(size_err_hd));
+
+  assert_ptrdiff((nghttp2_ssize)sizeof(size_err_hd), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  nghttp2_session_del(session);
+
+  /* PRIORITY_UPDATE on stream 1 + FRAME_SIZE_ERROR */
+  memset(&callbacks, 0, sizeof(callbacks));
+
+  nghttp2_session_server_new2(&session, &callbacks, NULL, option);
+
+  extfr.payload = &priority_update;
+  nghttp2_frame_priority_update_init(&extfr, 1, (uint8_t *)field_value,
+                                     sizeof(field_value) - 1);
+  nghttp2_bufs_reset(&bufs);
+  nghttp2_frame_pack_priority_update(&bufs, &extfr);
+  buf = &bufs.head->buf;
+  /* Set invalid stream ID 1 */
+  buf->pos[5 + sizeof(uint32_t) - 1] = 1;
+
+  rv = nghttp2_session_mem_recv2(session, buf->pos, nghttp2_bufs_len(&bufs));
+
+  assert_ptrdiff((nghttp2_ssize)nghttp2_bufs_len(&bufs), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  rv = nghttp2_session_mem_recv2(session, size_err_hd, sizeof(size_err_hd));
+
+  assert_ptrdiff((nghttp2_ssize)sizeof(size_err_hd), ==, rv);
+  assert_enum(nghttp2_inbound_state, NGHTTP2_IB_IGN_ALL, ==,
+              session->iframe.state);
+
+  nghttp2_session_del(session);
+
+  nghttp2_buf_free(&udbuf, mem);
+  nghttp2_buf_free(&ud.scratchbuf, mem);
+  nghttp2_bufs_free(&bufs);
+  nghttp2_option_del(option);
+}
+
 typedef struct check_http_opts {
   int server;
   int connect_protocol;

tests/nghttp2_session_test.h

@@ -153,6 +153,7 @@ munit_void_test_decl(test_nghttp2_session_no_closed_streams)
 munit_void_test_decl(test_nghttp2_session_set_stream_user_data)
 munit_void_test_decl(test_nghttp2_session_no_rfc7540_priorities)
 munit_void_test_decl(test_nghttp2_session_stream_reset_ratelim)
+munit_void_test_decl(test_nghttp2_session_verify_iframe_state)
 munit_void_test_decl(test_nghttp2_http_mandatory_headers)
 munit_void_test_decl(test_nghttp2_http_content_length)
 munit_void_test_decl(test_nghttp2_http_content_length_mismatch)