Fix bug in HTTP header parsing

runtime/bin/http_parser.dart

 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 // Global constants.
 class _Const {
   // Bytes for "HTTP/1.0".
   static final HTTP10 = const [72, 84, 84, 80, 47, 49, 46, 48];
   // Bytes for "HTTP/1.1".
   static final HTTP11 = const [72, 84, 84, 80, 47, 49, 46, 49];
@@ skipping 241 matching lines @@
               // Start of new header field.
               _headerField.addCharCode(_toLowerCase(byte));
               _state = _State.HEADER_FIELD;
             }
             break;
 
           case _State.HEADER_FIELD:
             if (byte == _CharCode.COLON) {
               _state = _State.HEADER_VALUE_START;
             } else {
+              if (!_isTokenChar(byte)) {
+                throw new HttpParserException("Invalid header field name");
+              }
               _headerField.addCharCode(_toLowerCase(byte));
             }
             break;
 
           case _State.HEADER_VALUE_START:
-            if (byte != _CharCode.SP && byte != _CharCode.HT) {
+            if (byte == _CharCode.CR) {
+              _state = _State.HEADER_VALUE_FOLDING_OR_ENDING;
+            } else if (byte != _CharCode.SP && byte != _CharCode.HT) {
               // Start of new header value.
               _headerValue.addCharCode(byte);
               _state = _State.HEADER_VALUE;
             }
             break;
 
           case _State.HEADER_VALUE:
             if (byte == _CharCode.CR) {
               _state = _State.HEADER_VALUE_FOLDING_OR_ENDING;
             } else {
@@ skipping 233 matching lines @@
     _contentLength = -1;
     _keepAlive = false;
     _connectionClose = false;
     _chunked = false;
 
     _noMessageBody = false;
     _responseToMethod = null;
     _remainingContent = null;
   }
 
+  bool _isTokenChar(int byte) {
+    return byte > 31 && byte < 128 && _Const.SEPARATORS.indexOf(byte) == -1;
+  }
+
   int _toLowerCase(int byte) {
     final int aCode = "A".charCodeAt(0);
     final int zCode = "Z".charCodeAt(0);
     final int delta = "a".charCodeAt(0) - aCode;
     return (aCode <= byte && byte <= zCode) ? byte + delta : byte;
   }
 
   int _expect(int val1, int val2) {
     if (val1 != val2) {
       throw new HttpParserException("Failed to parse HTTP");
@@ skipping 38 matching lines @@
   Function dataEnd;
   Function error;
 }
 
 
 class HttpParserException implements Exception {
   const HttpParserException([String this.message = ""]);
   String toString() => "HttpParserException: $message";
   final String message;
 }