Component updater must enforce that the brand length is 4.

components/update_client/utils.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/update_client/utils.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
@@ skipping 213 matching lines @@
   scoped_ptr<crypto::SecureHash> hasher(
       crypto::SecureHash::Create(crypto::SecureHash::SHA256));
   hasher->Update(mmfile.data(), mmfile.length());
   hasher->Finish(actual_hash, sizeof(actual_hash));
 
   return memcmp(actual_hash, &expected_hash[0], sizeof(actual_hash)) == 0;
 }
 
 bool IsValidBrand(const std::string& brand) {
   const size_t kMaxBrandSize = 4;
-  if (brand.size() > kMaxBrandSize)
+  if (!brand.empty() && brand.size() != kMaxBrandSize)
     return false;
 
   return std::find_if_not(brand.begin(), brand.end(), [](char ch) {
            return base::IsAsciiAlpha(ch);
          }) == brand.end();
 }
 
 bool IsValidAp(const std::string& ap) {
   const size_t kMaxApSize = 256;
   if (ap.size() > kMaxApSize)
@@ skipping 15 matching lines @@
 
 void RemoveUnsecureUrls(std::vector<GURL>* urls) {
   DCHECK(urls);
   urls->erase(std::remove_if(
                   urls->begin(), urls->end(),
                   [](const GURL& url) { return !url.SchemeIsCryptographic(); }),
               urls->end());
 }
 
 }  // namespace update_client