Description of problem:

If a request is refused because of invalid characters (CVE-2016-6816), it gets a 505 response instead of a 400.  The 400 is initially set as expected:

16:26:13,426 INFO  [stdout] (http-127.0.0.1:8080-1) --------------------------->Response.setStatus400
16:26:13,427 INFO  [stdout] (http-127.0.0.1:8080-1) org.apache.coyote.Response.setStatus(Response.java:-1)
16:26:13,427 INFO  [stdout] (http-127.0.0.1:8080-1) org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:832)
16:26:13,428 INFO  [stdout] (http-127.0.0.1:8080-1) org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:656)
16:26:13,428 INFO  [stdout] (http-127.0.0.1:8080-1) org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926)
16:26:13,428 INFO  [stdout] (http-127.0.0.1:8080-1) java.lang.Thread.run(Thread.java:745)

But then prepareRequest is called and sets a 505 since it doesn't see a proper protocol:

16:26:13,430 INFO  [stdout] (http-127.0.0.1:8080-1) --------------------------->Response.setStatus505
16:26:13,431 INFO  [stdout] (http-127.0.0.1:8080-1) org.apache.coyote.Response.setStatus(Response.java:-1)
16:26:13,431 INFO  [stdout] (http-127.0.0.1:8080-1) org.apache.coyote.http11.Http11Processor.prepareRequest(Http11Processor.java:1217)
16:26:13,432 INFO  [stdout] (http-127.0.0.1:8080-1) org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:839)
16:26:13,432 INFO  [stdout] (http-127.0.0.1:8080-1) org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:656)
16:26:13,433 INFO  [stdout] (http-127.0.0.1:8080-1) org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:926)
16:26:13,433 INFO  [stdout] (http-127.0.0.1:8080-1) java.lang.Thread.run(Thread.java:745)



How reproducible:

Always


Steps to Reproduce:
1. Launch 6.4.13+
2.
3.

Actual results:

505 response


Expected results:

400 response


Additional info:

Looks like similar concerns were fixed previously in tomcat with https://bz.apache.org/bugzilla/show_bug.cgi?id=46984.  If an error is already detected, Http11Processor.process shouldn't proceed to call prepareRequest().