net: fix buffer overflow in GHASH.

crypto/ghash.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "crypto/ghash.h"
 
 #include "base/logging.h"
 #include "base/sys_byteorder.h"
 
 namespace crypto {
@@ skipping 211 matching lines @@
     y_.low ^= Get64(bytes);
     bytes += 8;
     y_.hi ^= Get64(bytes);
     bytes += 8;
     MulAfterPrecomputation(product_table_, &y_);
   }
 }
 
 void GaloisHash::Update(const uint8* data, size_t length) {
   if (buf_used_ > 0) {
-    const size_t n = std::min(length, buf_used_);
+    const size_t n = std::min(length, sizeof(buf_) - buf_used_);
     memcpy(&buf_[buf_used_], data, n);
     buf_used_ += n;
     length -= n;
     data += n;
 
     if (buf_used_ == sizeof(buf_)) {
       UpdateBlocks(buf_, 1);
       buf_used_ = 0;
     }
   }
 
   if (length >= 16) {
     const size_t n = length / 16;
     UpdateBlocks(data, n);
     length -= n*16;
     data += n*16;
   }
 
   if (length > 0) {
     memcpy(buf_, data, length);
     buf_used_ = length;
   }
 }
 
 }  // namespace crypto