net/spdy: fail closed on invalid CONNECT response headers

OnHeadersReceived() ignored the return value of
SpdyHeadersToHttpResponse(); on a malformed CONNECT response the
response_ headers stayed null and DoReadReplyComplete() dereferenced
them.

Guard response_.headers in DoReadReplyComplete() and fail the tunnel
with ERR_TUNNEL_CONNECTION_FAILED. Both the normal CONNECT path and
the Fast Open path funnel through DoReadReplyComplete(), so a single
null check covers both, and OnHeadersReceived() stays unchanged from
upstream.

Closes audit finding F2 (SPDY OnHeadersReceived null dereference).

(cherry picked from commit afce211960e3ec092aa5347bbe6b9e2d63691d34)

src/net/spdy/spdy_proxy_client_socket.cc

@@ -554,6 +554,12 @@ int SpdyProxyClientSocket::DoReadReplyComplete(int result) {
   if (result < 0)
     return result;
 
+  // SpdyHeadersToHttpResponse() may have failed to convert the response
+  // headers (e.g. duplicate location values), in which case
+  // response_.headers is null and must not be dereferenced.
+  if (!response_.headers)
+    return ERR_TUNNEL_CONNECTION_FAILED;
+
   // Require the "HTTP/1.x" status line for SSL CONNECT.
   if (response_.headers->GetHttpVersion() < HttpVersion(1, 0))
     return ERR_TUNNEL_CONNECTION_FAILED;