Fix: Off-by-one error in LowLevelPolicy::Done.

sandbox/src/policy_low_level.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 #include <map>
 
 #include "sandbox/src/policy_low_level.h"
 #include "base/basictypes.h"
 
@@ skipping 59 matching lines @@
     mmap[it->service].push_back(it->rule);
   }
 
   PolicyBuffer* current_buffer = &policy_store_->data[0];
   char* buffer_end = reinterpret_cast<char*>(current_buffer) +
     policy_store_->data_size;
   size_t avail_size =  policy_store_->data_size;
 
   for (Mmap::iterator it = mmap.begin(); it != mmap.end(); ++it) {
     uint32 service = (*it).first;
-    if (service > kMaxServiceCount) {
+    if (service >= kMaxServiceCount) {
       return false;
     }
     policy_store_->entry[service] = current_buffer;
 
     RuleList::iterator rules_it = (*it).second.begin();
     RuleList::iterator rules_it_end = (*it).second.end();
 
     size_t svc_opcode_count = 0;
 
     for (; rules_it != rules_it_end; ++rules_it) {
@@ skipping 248 matching lines @@
 
   return true;
 }
 
 PolicyRule::~PolicyRule() {
   delete [] reinterpret_cast<char*>(buffer_);
   delete opcode_factory_;
 }
 
 }  // namespace sandbox