[Downloads] BaseFile shouldn't read past the expected EOF for a stub file.

content/browser/download/base_file.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/download/base_file.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/files/file.h"
@@ skipping 201 matching lines @@
 
   if (bytes_so_far_ == 0)
     return DOWNLOAD_INTERRUPT_REASON_NONE;
 
   if (file_.Seek(base::File::FROM_BEGIN, 0) != 0)
     return LogSystemError("Seek partial file",
                           logging::GetLastSystemErrorCode());
 
   const size_t kMinBufferSize = secure_hash_->GetHashLength();
   const size_t kMaxBufferSize = 1024 * 512;
+  static_assert(kMaxBufferSize <= std::numeric_limits<int>::max(),
+                "kMaxBufferSize must fit on an int");
 
   // The size of the buffer is:
   // - at least kMinBufferSize so that we can use it to hold the hash as well.
   // - at most kMaxBufferSize so that there's a reasonable bound.
   // - not larger than |bytes_so_far_| unless bytes_so_far_ is less than the
   //   hash size.
-  std::vector<char> buffer(std::max(
-      kMinBufferSize, std::min<size_t>(kMaxBufferSize, bytes_so_far_)));
+  std::vector<char> buffer(std::max<int64_t>(
+      kMinBufferSize, std::min<int64_t>(kMaxBufferSize, bytes_so_far_)));
 
   int64_t current_position = 0;
   while (current_position < bytes_so_far_) {
-    int length = file_.ReadAtCurrentPos(&buffer.front(), buffer.size());
+    // While std::min needs to work with int64_t, the result is always at most
+    // kMaxBufferSize, which fits on an int.
+    int bytes_to_read =
+        std::min<int64_t>(buffer.size(), bytes_so_far_ - current_position);
+    int length = file_.ReadAtCurrentPos(&buffer.front(), bytes_to_read);
     if (length == -1) {
       return LogInterruptReason("Reading partial file",
                                 logging::GetLastSystemErrorCode(),
                                 DOWNLOAD_INTERRUPT_REASON_FILE_TOO_SHORT);
     }
 
     if (length == 0)
       break;
 
     secure_hash_->Update(&buffer.front(), length);
@@ skipping 122 matching lines @@
   DVLOG(1) << __FUNCTION__ << "() operation:" << operation
            << " os_error:" << os_error
            << " reason:" << DownloadInterruptReasonToString(reason);
   bound_net_log_.AddEvent(
       net::NetLog::TYPE_DOWNLOAD_FILE_ERROR,
       base::Bind(&FileInterruptedNetLogCallback, operation, os_error, reason));
   return reason;
 }
 
 }  // namespace content