Add bounds check for negative ctrlsrc->z.

chrome/installer/setup/archive_patch_helper_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/path_service.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/installer/setup/archive_patch_helper.h"
@@ skipping 41 matching lines @@
   base::FilePath dest = test_dir_.path().AppendASCII("archive2.7z");
   installer::ArchivePatchHelper archive_helper(test_dir_.path(),
                                                base::FilePath(),
                                                src,
                                                dest);
   archive_helper.set_last_uncompressed_file(patch);
   EXPECT_TRUE(archive_helper.EnsemblePatch() || archive_helper.BinaryPatch());
   base::FilePath base = data_dir_.AppendASCII("archive2.7z");
   EXPECT_TRUE(base::ContentsEqual(dest, base));
 }
+
+TEST_F(ArchivePatchHelperTest, InvalidDiff_MisalignedCblen) {
+  base::FilePath src = data_dir_.AppendASCII("bin.old");
+  base::FilePath patch = data_dir_.AppendASCII("misaligned_cblen.diff");
+  base::FilePath dest = test_dir_.path().AppendASCII("bin.new");
+  installer::ArchivePatchHelper archive_helper(test_dir_.path(),
+                                               base::FilePath(),
+                                               src,
+                                               dest);
+  archive_helper.set_last_uncompressed_file(patch);
+  // Should fail, but not crash.
+  EXPECT_FALSE(archive_helper.BinaryPatch());
+}
+
+TEST_F(ArchivePatchHelperTest, InvalidDiff_NegativeSeek) {
+  base::FilePath src = data_dir_.AppendASCII("bin.old");
+  base::FilePath patch = data_dir_.AppendASCII("negative_seek.diff");
+  base::FilePath dest = test_dir_.path().AppendASCII("bin.new");
+  installer::ArchivePatchHelper archive_helper(test_dir_.path(),
+                                               base::FilePath(),
+                                               src,
+                                               dest);
+  archive_helper.set_last_uncompressed_file(patch);
+  // Should fail, but not crash.
+  EXPECT_FALSE(archive_helper.BinaryPatch());
+}