Fix bug that nghttp2_session_set_next_stream_id accepts invalid stream_id

lib/includes/nghttp2/nghttp2.h

@@ -2707,7 +2707,9 @@ NGHTTP2_EXTERN uint32_t
  *
  * :enum:`NGHTTP2_ERR_INVALID_ARGUMENT`
  *     The |next_stream_id| is strictly less than the value
- *     `nghttp2_session_get_next_stream_id()` returns.
+ *     `nghttp2_session_get_next_stream_id()` returns; or
+ *     |next_stream_id| is invalid (e.g., even integer for client, or
+ *     odd integer for server).
  */
 NGHTTP2_EXTERN int nghttp2_session_set_next_stream_id(nghttp2_session *session,
                                                       int32_t next_stream_id);

lib/nghttp2_session.c

@@ -6622,11 +6622,19 @@ int nghttp2_session_consume_stream(nghttp2_session *session, int32_t stream_id,
 
 int nghttp2_session_set_next_stream_id(nghttp2_session *session,
                                        int32_t next_stream_id) {
-  if (next_stream_id < 0 ||
+  if (next_stream_id <= 0 ||
       session->next_stream_id > (uint32_t)next_stream_id) {
     return NGHTTP2_ERR_INVALID_ARGUMENT;
   }
 
+  if (session->server) {
+    if (next_stream_id % 2) {
+      return NGHTTP2_ERR_INVALID_ARGUMENT;
+    }
+  } else if (next_stream_id % 2 == 0) {
+    return NGHTTP2_ERR_INVALID_ARGUMENT;
+  }
+
   session->next_stream_id = next_stream_id;
   return 0;
 }