Fix off-by-one in SpdyFramer.

net/spdy/spdy_framer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/spdy/spdy_framer.h"
 
 #include "base/lazy_instance.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/third_party/valgrind/memcheck.h"
 #include "net/spdy/spdy_frame_builder.h"
@@ skipping 2950 matching lines @@
   z_stream* compressor = GetHeaderCompressor();
   // Since we'll be performing lots of flushes when compressing the data,
   // zlib's lower bounds may be insufficient.
   return 2 * deflateBound(compressor, uncompressed_length);
 }
 
 size_t SpdyFramer::GetNumberRequiredContinuationFrames(size_t size) {
   DCHECK_GT(protocol_version(), SPDY3);
   DCHECK_GT(size, kMaxControlFrameSize);
   size_t overflow = size - kMaxControlFrameSize;
-  return overflow / (kMaxControlFrameSize - GetContinuationMinimumSize()) + 1;
+  size_t payload_size = kMaxControlFrameSize - GetContinuationMinimumSize();
+  // This is ceiling(overflow/payload_size) using integer arithmetics.
+  return (overflow - 1) / payload_size + 1;

[Ryan Hamilton, 2015/03/09 17:50:08]

Looks like this has not yet been fixed in google3's framer. Does this need to be
fixed there too?

 }
 
 void SpdyFramer::WritePayloadWithContinuation(SpdyFrameBuilder* builder,
                                               const string& hpack_encoding,
                                               SpdyStreamId stream_id,
                                               SpdyFrameType type,
                                               int padding_payload_len) {
   uint8 end_flag = 0;
   uint8 flags = 0;
   if (type == HEADERS) {
@@ skipping 295 matching lines @@
 #else
   WriteHeaderBlockToZ(&frame.name_value_block(), compressor);
 #endif  // defined(USE_SYSTEM_ZLIB)
 
   int compressed_size = compressed_max_size - compressor->avail_out;
   builder->Seek(compressed_size);
   builder->RewriteLength(*this);
 }
 
 }  // namespace net