SPDY: heap buffer overflow (bugfix for CVE-2014-0133)

More details from nginx announcement are available here:
 http://mailman.nginx.org/pipermail/nginx-announce/2014/000135.html

Note that, this commit also contains two patches given by Maxim Dounin later,
which can avoid the potential problem in case of `end - pos < 0`.