Inconsistency in vtc_http2 parse_hdr

[nigoroll]

Coverity CID 1605314 Overflowed return value

varnish-cache/bin/varnishtest/vtc_http2.c

Lines 505 to 514 in 33d8a53

	if (f->md.padded >= size) {
	vtc_log(s->vl, hp->fatal,
	"invalid padding: %d reported,"
	"but size is only %d",
	f->md.padded, size);
	size = 0;
	f->md.padded = 0;
	}
	shift += 1;
	size -= f->md.padded;

for f->md.padded >= size increminting shift by one actually looks wrong to me. And why shift += 1 in the first place and not shift += f->md.padded?

Edit: Very similar issue here:

varnish-cache/bin/varnishtest/vtc_http2.c

Lines 417 to 426 in 33d8a53

	if (f->md.padded >= size) {
	vtc_log(s->vl, hp->fatal,
	"invalid padding: %d reported,"
	"but size is only %d",
	f->md.padded, size);
	size = 0;
	f->md.padded = 0;
	}
	data++;
	size -= f->md.padded + 1;

[bsdphk]

I think this looks mostly correct.

shift is where data starts, and the length of the padding goes in front of the data (rfc7540 p30)

But I'm wondering now if it shouldn't be size -= 1 + f->md.padded also in line 514 ?