Use the correct remaining data length when parsing chunk headers.

chrome/browser/safe_browsing/protocol_parser_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
 // Program to test the SafeBrowsing protocol parsing v2.1.
 
 #include "base/stringprintf.h"
 #include "chrome/browser/safe_browsing/protocol_parser.h"
 #include "chrome/browser/safe_browsing/safe_browsing_util.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ skipping 205 matching lines @@
 
   // For safe_browsing_util::kBinUrlList.
   result = parser.ParseChunk(safe_browsing_util::kBinUrlList,
                              add_chunk,
                              static_cast<int>(sizeof(add_chunk)),
                              &chunks);
   EXPECT_FALSE(result);
   EXPECT_EQ(chunks.size(), 0U);
 }
 
+// Test to verify handling of a truncated chunk header.
+TEST(SafeBrowsingProtocolParsingTest, TestTruncatedHeader) {
+  std::string truncated_chunks("a:1:4:0\na:");
+
+  // Run the parser.
+  SafeBrowsingProtocolParser parser;
+  SBChunkList chunks;
+  bool result = parser.ParseChunk(
+      safe_browsing_util::kMalwareList,
+      truncated_chunks.data(),
+      static_cast<int>(truncated_chunks.length()),
+      &chunks);
+  EXPECT_FALSE(result);
+}
+
 // Test parsing one sub chunk.
 TEST(SafeBrowsingProtocolParsingTest, TestSubChunk) {
   std::string sub_chunk("s:9:4:59\naaaaxkkkk1111\003"
                         "zzzz2222zzzz3333zzzz4444"
                         "7777\002yyyy8888yyyy9999");
   sub_chunk[13] = '\0';
 
   // Run the parse.
   SafeBrowsingProtocolParser parser;
   SBChunkList chunks;
@@ skipping 524 matching lines @@
   EXPECT_EQ(chunks[0].hosts[0].host, 0);
   SBEntry* entry = chunks[0].hosts[0].entry;
   EXPECT_TRUE(entry->IsSub());
   ASSERT_FALSE(entry->IsPrefix());
   ASSERT_EQ(entry->prefix_count(), 1);
   EXPECT_EQ(entry->ChunkIdAtPrefix(0), 0x31313131);
   SBFullHash full;
   memcpy(full.full_hash, "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", 32);
   EXPECT_TRUE(entry->FullHashAt(0) == full);
 }