diff --git a/okhttp-protocols/src/main/java/com/squareup/okhttp/internal/spdy/Spdy3.java b/okhttp-protocols/src/main/java/com/squareup/okhttp/internal/spdy/Spdy3.java
index d233c2bea..122d371c2 100644
--- a/okhttp-protocols/src/main/java/com/squareup/okhttp/internal/spdy/Spdy3.java
+++ b/okhttp-protocols/src/main/java/com/squareup/okhttp/internal/spdy/Spdy3.java
@@ -284,10 +284,14 @@ final class Spdy3 implements Variant {
       this.compressedLimit += length;
       try {
         int numberOfPairs = nameValueBlockIn.readInt();
-        if ((numberOfPairs * 2) < 0) {
+        if (numberOfPairs < 0) {
           Logger.getLogger(getClass().getName()).warning("numberOfPairs < 0: " + numberOfPairs);
           throw ioException("numberOfPairs < 0");
         }
+        if (numberOfPairs > 1024) {
+          Logger.getLogger(getClass().getName()).warning("numberOfPairs > 1024: " + numberOfPairs);
+          throw ioException("numberOfPairs > 1024");
+        }
         List<String> entries = new ArrayList<String>(numberOfPairs * 2);
         for (int i = 0; i < numberOfPairs; i++) {
           String name = readString();