SPDY: Handle incorrect number of headers when parsing frame headers.

net/spdy/spdy_framer.cc

Index: net/spdy/spdy_framer.cc
diff --git a/net/spdy/spdy_framer.cc b/net/spdy/spdy_framer.cc
index 0a1c2b74a12a8340c818b95dbc2d194af7f3660a..cd573a5631e166ae758fb0e478f1ef8e136798cb 100644
--- a/net/spdy/spdy_framer.cc
+++ b/net/spdy/spdy_framer.cc
@@ -470,7 +470,8 @@ bool SpdyFramer::ParseHeaderBlock(const SpdyFrame* frame,
   void* iter = NULL;
   uint16 num_headers;
   if (builder.ReadUInt16(&iter, &num_headers)) {
-    for (int index = 0; index < num_headers; ++index) {
+    int index = 0;
+    for ( ; index < num_headers; ++index) {
       std::string name;
       std::string value;
       if (!builder.ReadString(&iter, &name))
@@ -485,7 +486,8 @@ bool SpdyFramer::ParseHeaderBlock(const SpdyFrame* frame,
         return false;
       }
     }
-    return true;
+    return index == num_headers &&
+        iter == header_data + header_length;
   }
   return false;
 }