ui: Fix potential out-of-bounds array access in EDID parser

ui/display/util/edid_parser.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/display/util/edid_parser.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 
@@ skipping 217 matching lines @@
 
     for (size_t data_offset = extension_offset + kDataBlockOffset;
          data_offset < extension_offset + timing_descriptors_start;) {
       // A data block is encoded as:
       // - byte 1 high 3 bits: tag. '07' for extended tags.
       // - byte 1 remaining bits: the length of data block.
       // - byte 2: the extended tag.  '0' for video capability.
       // - byte 3: the capability.
       unsigned char tag = edid[data_offset] >> 5;
       unsigned char payload_length = edid[data_offset] & 0x1f;
-      if (data_offset + payload_length > edid.size())
+      if (data_offset + payload_length + 1 > edid.size())
         break;
 
       if (tag != kExtendedTag || payload_length < 2 ||
           edid[data_offset + 1] != kExtendedVideoCapabilityTag) {
         data_offset += payload_length + 1;
         continue;
       }
 
       // The difference between preferred, IT, and CE video formats
       // doesn't matter. Sets |flag| to true if any of these flags are true.
       if ((edid[data_offset + 2] & (1 << kPTOverscan)) ||
           (edid[data_offset + 2] & (1 << kITOverscan)) ||
           (edid[data_offset + 2] & (1 << kCEOverscan))) {
         *flag = true;
       } else {
         *flag = false;
       }
       return true;
     }
   }
 
   return false;
 }
 
 }  // namespace ui