Avoid chunk header parsing overflow.

Recharacterize the chunk header states such that they are bound by the check
for HTTP_MAX_HEADER_SIZE.

http_parser.c

@@ -240,15 +240,17 @@ enum state
 
   , s_header_almost_done
 
+  , s_chunk_size_start
+  , s_chunk_size
+  , s_chunk_parameters
+  , s_chunk_size_almost_done
+  
   , s_headers_almost_done
   /* Important: 's_headers_almost_done' must be the last 'header' state. All
    * states beyond this must be 'body' states. It is used for overflow
    * checking. See the PARSING_HEADER() macro.
    */
-  , s_chunk_size_start
+
-  , s_chunk_size
-  , s_chunk_size_almost_done
-  , s_chunk_parameters
   , s_chunk_data
   , s_chunk_data_almost_done
   , s_chunk_data_done
@@ -1458,6 +1460,7 @@ size_t http_parser_execute (http_parser *parser,
 
       case s_chunk_size_start:
       {
+        assert(nread == 1);
         assert(parser->flags & F_CHUNKED);
 
         c = unhex[(unsigned char)ch];
@@ -1507,6 +1510,8 @@ size_t http_parser_execute (http_parser *parser,
         assert(parser->flags & F_CHUNKED);
         STRICT_CHECK(ch != LF);
 
+        nread = 0;
+
         if (parser->content_length == 0) {
           parser->flags |= F_TRAILING;
           state = s_header_field_start;