Do not use SpdyFrameBuilder::OverwriteLength().

net/spdy/spdy_frame_builder.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SPDY_SPDY_FRAME_BUILDER_H_
 #define NET_SPDY_SPDY_FRAME_BUILDER_H_
 
 #include <stddef.h>
 #include <stdint.h>
 
@@ skipping 40 matching lines @@
   // GetWriteableBuffer() above.
   bool Seek(size_t length);
 
   // Populates this frame with a HTTP2 frame prefix using length information
   // from |capacity_|. The given type must be a control frame type.
   bool BeginNewFrame(const SpdyFramer& framer,
                      SpdyFrameType type,
                      uint8_t flags,
                      SpdyStreamId stream_id);
 
+  // Populates this frame with a HTTP2 frame prefix with length information.
+  // The given type must be a control frame type.
+  bool BeginNewFrame(const SpdyFramer& framer,
+                     SpdyFrameType type,
+                     uint8_t flags,
+                     SpdyStreamId stream_id,
+                     size_t length);
+
   // Takes the buffer from the SpdyFrameBuilder.
   SpdySerializedFrame take() {
     SPDY_BUG_IF(kMaxFrameSizeLimit < length_)
         << "Frame length " << length_
         << " is longer than the maximum possible allowed length.";
     SpdySerializedFrame rv(buffer_.release(), length(), true);
     capacity_ = 0;
     length_ = 0;
     offset_ = 0;
     return rv;
@@ skipping 51 matching lines @@
 
   std::unique_ptr<char[]> buffer_;
   size_t capacity_;  // Allocation size of payload, set by constructor.
   size_t length_;    // Length of the latest frame in the buffer.
   size_t offset_;    // Position at which the latest frame begins.
 };
 
 }  // namespace net
 
 #endif  // NET_SPDY_SPDY_FRAME_BUILDER_H_