SVGLength: Avoid reading out-of-bounds when parsing incorrect 'rem' unit

Source/core/svg/SVGLength.cpp

 /*
  * Copyright (C) 2004, 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007 Rob Buis <buis@kde.org>
  * Copyright (C) 2007 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 80 matching lines @@
             if (secondChar == 't')
                 type = LengthTypePT;
             if (secondChar == 'c')
                 type = LengthTypePC;
         } else if (firstChar == 'e') {
             if (secondChar == 'm')
                 type = LengthTypeEMS;
             if (secondChar == 'x')
                 type = LengthTypeEXS;
         } else if (firstChar == 'r') {
-            if (secondChar == 'e') {
+            if (secondChar == 'e' && ptr < end) {
                 const CharType thirdChar = *ptr++;
                 if (thirdChar == 'm')
                     type = LengthTypeREMS;
             }
         } else if (firstChar == 'c' && secondChar == 'm') {
             type = LengthTypeCM;
         } else if (firstChar == 'm' && secondChar == 'm') {
             type = LengthTypeMM;
         } else if (firstChar == 'i' && secondChar == 'n') {
             type = LengthTypeIN;
@@ skipping 361 matching lines @@
 
 float SVGLength::calculateDistance(PassRefPtrWillBeRawPtr<SVGPropertyBase> toValue, SVGElement* contextElement)
 {
     SVGLengthContext lengthContext(contextElement);
     RefPtrWillBeRawPtr<SVGLength> toLength = toSVGLength(toValue);
 
     return fabsf(toLength->value(lengthContext) - value(lengthContext));
 }
 
 }