unicode-decoder: fix out-of-band write in utf16

src/unicode-decoder.h

Index: src/unicode-decoder.h
diff --git a/src/unicode-decoder.h b/src/unicode-decoder.h
index bfb14a38555244c529761724e901aa41584d8900..c03084116603c5db734f1d471e25fa92e1106623 100644
--- a/src/unicode-decoder.h
+++ b/src/unicode-decoder.h
@@ -23,9 +23,10 @@ class Utf8DecoderBase {
   // The first buffer_length utf16 chars are cached in the buffer.
   void Reset(uint16_t* buffer, size_t buffer_length, const uint8_t* stream,
              size_t stream_length);
-  static void WriteUtf16Slow(const uint8_t* stream, uint16_t* data,
-                             size_t length);
+  static void WriteUtf16Slow(const uint8_t* stream, size_t stream_length,
+                             uint16_t* data, size_t length);
   const uint8_t* unbuffered_start_;
+  size_t unbuffered_length_;
   size_t utf16_length_;
   bool last_byte_of_buffer_unused_;
 
@@ -48,6 +49,7 @@ class Utf8Decoder : public Utf8DecoderBase {
 
 Utf8DecoderBase::Utf8DecoderBase()
     : unbuffered_start_(NULL),
+      unbuffered_length_(0),
       utf16_length_(0),
       last_byte_of_buffer_unused_(false) {}
 
@@ -84,7 +86,7 @@ size_t Utf8Decoder<kBufferSize>::WriteUtf16(uint16_t* data,
   if (length <= buffer_length) return length;
   DCHECK(unbuffered_start_ != NULL);
   // Copy the rest the slow way.
-  WriteUtf16Slow(unbuffered_start_, data + buffer_length,
+  WriteUtf16Slow(unbuffered_start_, unbuffered_length_, data + buffer_length,
                  length - buffer_length);
   return length;
 }