Fix BOM handling in TextResourceDecoder on partial data

third_party/WebKit/Source/core/html/parser/TextResourceDecoder.cpp

 /*
     Copyright (C) 1999 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2012 Apple Inc. All rights reserved.
     Copyright (C) 2005, 2006, 2007 Alexey Proskuryakov (ap@nypop.com)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
     version 2 of the License, or (at your option) any later version.
 
@@ skipping 196 matching lines @@
     unsigned char c1 = buf1Len ? (--buf1Len, *buf1++) : buf2Len ? (--buf2Len, *buf2++) : 0;
     unsigned char c2 = buf1Len ? (--buf1Len, *buf1++) : buf2Len ? (--buf2Len, *buf2++) : 0;
     unsigned char c3 = buf1Len ? (--buf1Len, *buf1++) : buf2Len ? (--buf2Len, *buf2++) : 0;
     unsigned char c4 = buf2Len ? (--buf2Len, *buf2++) : 0;
 
     // Check for the BOM.
     if (c1 == 0xEF && c2 == 0xBB && c3 == 0xBF) {
         setEncoding(UTF8Encoding(), AutoDetectedEncoding);
         lengthOfBOM = 3;
     } else if (m_encodingDetectionOption != AlwaysUseUTF8ForText) {
-        if (c1 == 0xFF && c2 == 0xFE) {
+        if (c1 == 0xFF && c2 == 0xFE && bufferLength + len >= 4) {
             if (c3 || c4) {
                 setEncoding(UTF16LittleEndianEncoding(), AutoDetectedEncoding);
                 lengthOfBOM = 2;
             } else {
                 setEncoding(UTF32LittleEndianEncoding(), AutoDetectedEncoding);
                 lengthOfBOM = 4;
             }
         } else if (c1 == 0xFE && c2 == 0xFF) {
             setEncoding(UTF16BigEndianEncoding(), AutoDetectedEncoding);
             lengthOfBOM = 2;
@@ skipping 134 matching lines @@
 {
     // Just checking m_hintEncoding suffices here because it's only set
     // in setHintEncoding when the source is AutoDetectedEncoding.
     return m_encodingDetectionOption == UseAllAutoDetection
         && (m_source == DefaultEncoding || (m_source == EncodingFromParentFrame && m_hintEncoding));
 }
 
 String TextResourceDecoder::decode(const char* data, size_t len)
 {
     size_t lengthOfBOM = 0;
-    if (!m_checkedForBOM)
+    if (!m_checkedForBOM) {
         lengthOfBOM = checkForBOM(data, len);
+        if (!m_checkedForBOM) {

[kouhei (in TOK), 2016/08/06 01:16:31]

Would you add a comment above why we need this double check?

[tzik, 2016/08/07 10:18:45]

Done.

+            DCHECK_EQ(0u, lengthOfBOM);
+            m_buffer.append(data, len);
+            return emptyString();
+        }
+    }
+    DCHECK_LE(lengthOfBOM, m_buffer.size() + len);
 
     bool movedDataToBuffer = false;
 
     if (m_contentType == CSSContent && !m_checkedForCSSCharset) {
         if (!checkForCSSCharset(data, len, movedDataToBuffer))
             return emptyString();
     }
 
     // We check XML declaration in HTML content only if there is enough data available
     if (((m_contentType == HTMLContent && len >= minimumLengthOfXMLDeclaration) || m_contentType == XMLContent) && !m_checkedForXMLCharset) {
@@ skipping 51 matching lines @@
         m_codec = newTextCodec(m_encoding);
 
     String result = m_codec->decode(m_buffer.data(), m_buffer.size(), FetchEOF, m_contentType == XMLContent && !m_useLenientXMLDecoding, m_sawError);
     m_buffer.clear();
     m_codec.reset();
     m_checkedForBOM = false; // Skip BOM again when re-decoding.
     return result;
 }
 
 } // namespace blink