Properly handle zero-sized fields in the PReg parser.

chrome/browser/policy/preg_parser_win.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/preg_parser_win.h"
 
 #include <windows.h>
 
 #include <algorithm>
 #include <iterator>
@@ skipping 46 matching lines @@
     return -1;
 
   int result = **cursor | (*(*cursor + 1) << 8);
   *cursor += sizeof(char16);
   return result;
 }
 
 // Reads a fixed-size field from a PReg file.
 bool ReadFieldBinary(const uint8** cursor,
                      const uint8* end,
-                     int size,
+                     uint32 size,
                      uint8* data) {
-  if (!size)
-    return false;
+  if (size == 0)
+    return true;
+
   const uint8* field_end = *cursor + size;
-  if (field_end > end)
+  if (field_end <= *cursor || field_end > end)

[Joao da Silva, 2013/09/13 14:18:07]

if this accepted "field_end == *cursor" then it wouldn't be necessary to special
case "size == 0".

[Mattias Nissler (ping if slow), 2013/09/13 14:40:24]

The size == 0 check is here to handle the case of callers passing size = 0, data
= NULL gracefully. We can't forward data = NULL to std::copy as this triggers
asserts in the standard library.

     return false;
   std::copy(*cursor, field_end, data);
   *cursor = field_end;
   return true;
 }
 
 bool ReadField32(const uint8** cursor, const uint8* end, uint32* data) {
   uint32 value = 0;
   if (!ReadFieldBinary(cursor, end, sizeof(uint32),
                        reinterpret_cast<uint8*>(&value))) {
@@ skipping 213 matching lines @@
   }
 
   LOG(ERROR) << "Error parsing " << file_path.value() << " at offset "
              << reinterpret_cast<const uint8*>(cursor - 1) - mapped_file.data();
   status->Add(POLICY_LOAD_STATUS_PARSE_ERROR);
   return false;
 }
 
 }  // namespace preg_parser
 }  // namespace policy