Fix several potential buffer over-read errors in JSONParser::ConsumeNumber.

base/json/json_parser_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/json/json_parser.h"
 
 #include <stddef.h>
 
 #include <memory>
 
 #include "base/json/json_reader.h"
+#include "base/memory/ptr_util.h"
+#include "base/strings/stringprintf.h"
 #include "base/values.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace base {
 namespace internal {
 
 class JSONParserTest : public testing::Test {
  public:
   JSONParser* NewTestParser(const std::string& input,
                             int options = JSON_PARSE_RFC) {
@@ skipping 313 matching lines @@
   const std::string quoted_bogus_char = "\"" + bogus_char + "\"";
   std::unique_ptr<JSONParser> parser(
       NewTestParser(quoted_bogus_char, JSON_REPLACE_INVALID_CHARACTERS));
   std::unique_ptr<Value> value(parser->ConsumeString());
   ASSERT_TRUE(value.get());
   std::string str;
   EXPECT_TRUE(value->GetAsString(&str));
   EXPECT_EQ(kUnicodeReplacementString, str);
 }
 
+TEST_F(JSONParserTest, ParseNumberErrors) {
+  const struct {
+    const char* input;
+    bool parse_success;
+    double value;
+  } kCases[] = {
+      // clang-format off

[dcheng, 2017/02/24 21:15:31]

Is this necessary =P

[Robert Sesek, 2017/02/24 21:25:33]

I mean, no, but without this it tries to put three test cases on a line. I don't
see how that's better. And clang-format being terrible with tables seems like a
KI.

If you don't like it I'll let clang-format make me sad :P.

[dcheng, 2017/02/24 21:55:45]

I see your point. While I think we should be generally minimizing use of this, I
can look the other way =P

+      {"1", true, 1},
+      {"2.", false, 0},
+      {"42", true, 42},
+      {"6e", false, 0},
+      {"43e2", true, 4300},
+      {"43e-", false, 0},
+      {"9e-3", true, 0.009},
+      {"2e+", false, 0},
+      {"2e+2", true, 200},
+      // clang-format on
+  };
+
+  for (unsigned int i = 0; i < arraysize(kCases); ++i) {
+    auto test_case = kCases[i];
+    SCOPED_TRACE(StringPrintf("case %u: \"%s\"", i, test_case.input));
+
+    // MSan will do a better job detecting over-read errors if the input is
+    // not nul-terminated on the heap.
+    size_t str_len = strlen(test_case.input);
+    auto non_nul_termianted = MakeUnique<char[]>(str_len);
+    memcpy(non_nul_termianted.get(), test_case.input, str_len);
+
+    StringPiece string_piece(non_nul_termianted.get(), str_len);
+    std::unique_ptr<Value> result = JSONReader::Read(string_piece);
+    if (test_case.parse_success) {
+      EXPECT_TRUE(result);
+    } else {
+      EXPECT_FALSE(result);
+    }
+
+    if (!result)
+      continue;
+
+    double double_value = 0;
+    EXPECT_TRUE(result->GetAsDouble(&double_value));
+    EXPECT_EQ(test_case.value, double_value);
+  }
+}
+
 }  // namespace internal
 }  // namespace base