Guard against invalid name value block headers.

If a badly behaved server sends us a negative number
of name value blocks, we should throw an IOException and
not a RTE (which will be thrown when we try to construct an
ArrayList with a negative size).

src/main/java/com/squareup/okhttp/internal/spdy/SpdyReader.java

@@ -232,6 +232,10 @@ final class SpdyReader implements Closeable {
     this.compressedLimit += length;
     try {
       int numberOfPairs = nameValueBlockIn.readInt();
+      if (numberOfPairs < 0) {
+        Logger.getLogger(getClass().getName()).warning("numberOfPairs < 0: " + numberOfPairs);
+        throw ioException("numberOfPairs < 0");
+      }
       List<String> entries = new ArrayList<String>(numberOfPairs * 2);
       for (int i = 0; i < numberOfPairs; i++) {
         String name = readString();