UBSAN: Fix left-shifts of negative values in webusb_descriptors.cc.

device/usb/webusb_descriptors.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "device/usb/webusb_descriptors.h"
 
 #include <stddef.h>
 
 #include <iterator>
 #include <map>
@@ skipping 276 matching lines @@
     uint8_t vendor_code,
     UsbTransferStatus status,
     scoped_refptr<net::IOBuffer> buffer,
     size_t length) {
   if (status != USB_TRANSFER_COMPLETED || length != 4) {
     USB_LOG(EVENT) << "Failed to read WebUSB allowed origins header.";
     callback.Run(nullptr);
     return;
   }
 
-  uint16_t new_length = buffer->data()[2] | (buffer->data()[3] << 8);
+  const uint8_t* data = reinterpret_cast<uint8_t*>(buffer->data());
+  uint16_t new_length = data[2] | (data[3] << 8);
   scoped_refptr<IOBufferWithSize> new_buffer = new IOBufferWithSize(new_length);
   device_handle->ControlTransfer(
       USB_DIRECTION_INBOUND, UsbDeviceHandle::VENDOR, UsbDeviceHandle::DEVICE,
       vendor_code, 0, kGetAllowedOriginsRequest, new_buffer, new_buffer->size(),
       kControlTransferTimeout,
       base::Bind(&OnReadWebUsbAllowedOrigins, callback));
 }
 
 void ReadWebUsbAllowedOrigins(
     scoped_refptr<UsbDeviceHandle> device_handle,
@@ skipping 36 matching lines @@
                                const ReadWebUsbDescriptorsCallback& callback,
                                UsbTransferStatus status,
                                scoped_refptr<net::IOBuffer> buffer,
                                size_t length) {
   if (status != USB_TRANSFER_COMPLETED || length != 5) {
     USB_LOG(EVENT) << "Failed to read BOS descriptor header.";
     callback.Run(nullptr, GURL());
     return;
   }
 
-  uint16_t new_length = buffer->data()[2] | (buffer->data()[3] << 8);
+  const uint8_t* data = reinterpret_cast<uint8_t*>(buffer->data());
+  uint16_t new_length = data[2] | (data[3] << 8);
   scoped_refptr<IOBufferWithSize> new_buffer = new IOBufferWithSize(new_length);
   device_handle->ControlTransfer(
       USB_DIRECTION_INBOUND, UsbDeviceHandle::STANDARD, UsbDeviceHandle::DEVICE,
       kGetDescriptorRequest, kBosDescriptorType << 8, 0, new_buffer,
       new_buffer->size(), kControlTransferTimeout,
       base::Bind(&OnReadBosDescriptor, device_handle, callback));
 }
 
 }  // namespace
 
@@ skipping 223 matching lines @@
     for (const auto& function : config.functions) {
       if (ContainsValue(function.origins, origin))
         return true;
     }
   }
 
   return false;
 }
 
 }  // namespace device