Merge commit from fork

Author: trowski

src/Driver/Http1Driver.php

@@ -671,6 +671,14 @@ static function (int $bodySize) use (&$bodySizeLimit): void {
                             $this->updateTimeout();
 
                             if ($bufferLength >= $chunkLengthRemaining + 2) {
+                                if (\substr($buffer, $chunkLengthRemaining, 2) !== "\r\n") {
+                                    throw new ClientException(
+                                        $this->client,
+                                        "Bad Request: invalid chunk delimiter",
+                                        HttpStatus::BAD_REQUEST,
+                                    );
+                                }
+
                                 try {
                                     $queue->push(\substr($buffer, 0, $chunkLengthRemaining));
                                 } catch (DisposedException) {
@@ -762,7 +770,7 @@ static function (int $bodySize) use (&$bodySizeLimit): void {
                 $this->pendingResponseCount--;
             } while (!$this->upgraded);
         } catch (ClientException $exception) {
-            if ($this->bodyQueue === null || !$this->pendingResponseCount) {
+            if ($this->bodyQueue === null || $this->pendingResponseCount) {
                 // Send an error response only if another response has not already been sent to the request.
                 $this->sendErrorResponse($exception, $request ?? null)->await();
             }

test/Driver/Http1DriverTest.php

@@ -991,6 +991,47 @@ public function testBodylessResponseDoesNotDesyncConnection(): void
         );
     }
 
+    public function testMalformedChunk(): void
+    {
+        $driver = new Http1Driver(
+            new ClosureRequestHandler(function (Request $request) use (&$exception): Response {
+                $body = $request->getBody()->buffer();
+                return new Response(body: $body);
+            }),
+            $this->createMock(ErrorHandler::class),
+            new NullLogger,
+        );
+
+        $output = new WritableBuffer;
+
+        async(fn () => $driver->handleClient(
+            $this->createClientMock(),
+            new ReadableBuffer(
+                "POST /first HTTP/1.1\r\n" .
+                "Host: 127.0.0.1\r\n" .
+                "Connection: keep-alive\r\n" .
+                "Transfer-Encoding: chunked\r\n" .
+                "\r\n" .
+                "3\r\n" .   // chunk size = 3
+                "abc" .     // 3 bytes of chunk data
+                "AB" .      // malformed delimiter (0x41 0x42) instead of CRLF (0x0D 0x0A)
+                "0\r\n" .   // terminal chunk
+                "\r\n" .
+                "GET /admin HTTP/1.1\r\n" .
+                "Host: 127.0.0.1\r\n" .
+                "Connection: close\r\n" .
+                "\r\n"
+            ),
+            $output,
+        ));
+
+        delay(0.1);
+
+        $output->close();
+
+        self::assertStringStartsWith("HTTP/1.0 400 Bad Request\r\n", $output->buffer());
+    }
+
     public function testWriteAbortAfterHeaders(): void
     {
         $driver = new Http1Driver(