Prevent header NV allocation size overflow

[freedom-winds]

Summary

Add overflow checks to nghttp3_nva_copy before allocating storage for copied header names, values, and the NV array.

Details

nghttp3_nva_copy previously accumulated allocation sizes without checking integer overflow. Crafted namelen, valuelen, or nvlen values could wrap the calculated size, resulting in an undersized allocation followed by out-of-bounds memory writes during header copying.

This patch:

• Checks name-length and value-length additions.
• Checks nvlen * sizeof(nghttp3_nv).
• Checks the final allocation-size addition.
• Returns NGHTTP3_ERR_INVALID_ARGUMENT for overflowing inputs.

Validation

The modified source passes compiler syntax validation with -Wall -Wextra -Werror.