Fix off-by-one in SpdyFramer.

net/spdy/spdy_framer.cc

Index: net/spdy/spdy_framer.cc
diff --git a/net/spdy/spdy_framer.cc b/net/spdy/spdy_framer.cc
index dbb3fff59c8dd02ad781b11e8cfdf7ee3c30f101..4b5866e60077db58724a4f9ae04f09ebab9f464c 100644
--- a/net/spdy/spdy_framer.cc
+++ b/net/spdy/spdy_framer.cc
@@ -2968,7 +2968,9 @@ size_t SpdyFramer::GetNumberRequiredContinuationFrames(size_t size) {
   DCHECK_GT(protocol_version(), SPDY3);
   DCHECK_GT(size, kMaxControlFrameSize);
   size_t overflow = size - kMaxControlFrameSize;
-  return overflow / (kMaxControlFrameSize - GetContinuationMinimumSize()) + 1;
+  size_t payload_size = kMaxControlFrameSize - GetContinuationMinimumSize();
+  // This is ceiling(overflow/payload_size) using integer arithmetics.
+  return (overflow - 1) / payload_size + 1;

[Ryan Hamilton, 2015/03/09 17:50:08]

Looks like this has not yet been fixed in google3's framer. Does this need to be
fixed there too?

 }
 
 void SpdyFramer::WritePayloadWithContinuation(SpdyFrameBuilder* builder,