SPDY: Handle incorrect number of headers when parsing frame headers.

net/spdy/spdy_framer.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_framer.h"
 
 #include "base/scoped_ptr.h"
 #include "base/stats_counters.h"
 
 #include "net/spdy/spdy_frame_builder.h"
@@ skipping 452 matching lines @@
         header_data = syn_frame.header_block();
         header_length = syn_frame.header_block_len();
       }
       break;
   }
 
   SpdyFrameBuilder builder(header_data, header_length);
   void* iter = NULL;
   uint16 num_headers;
   if (builder.ReadUInt16(&iter, &num_headers)) {
-    for (int index = 0; index < num_headers; ++index) {
+    int index = 0;
+    for ( ; index < num_headers; ++index) {
       std::string name;
       std::string value;
       if (!builder.ReadString(&iter, &name))
         break;
       if (!builder.ReadString(&iter, &value))
         break;
       if (!name.size() || !value.size())
         return false;
       if (block->find(name) == block->end()) {
         (*block)[name] = value;
       } else {
         return false;
       }
     }
-    return true;
+    return index == num_headers &&
+        iter == header_data + header_length;
   }
   return false;
 }
 
 /* static */
 bool SpdyFramer::ParseSettings(const SpdySettingsControlFrame* frame,
                                SpdySettings* settings) {
   DCHECK_EQ(frame->type(), SETTINGS);
   DCHECK(settings);
 
@@ skipping 578 matching lines @@
 void SpdyFramer::set_enable_compression(bool value) {
   enable_compression_ = value;
 }
 
 void SpdyFramer::set_enable_compression_default(bool value) {
   compression_default_ = value;
 }
 
 }  // namespace spdy