Fix several potential buffer over-read errors in JSONParser::ConsumeNumber.

base/json/json_parser_unittest.cc

Index: base/json/json_parser_unittest.cc
diff --git a/base/json/json_parser_unittest.cc b/base/json/json_parser_unittest.cc
index d004c480cf66702c4a412b385f5a08a86f3de2f3..e3f635b76f1361f3c1bb8db00ffa5d20b0410d4a 100644
--- a/base/json/json_parser_unittest.cc
+++ b/base/json/json_parser_unittest.cc
@@ -9,6 +9,8 @@
 #include <memory>
 
 #include "base/json/json_reader.h"
+#include "base/memory/ptr_util.h"
+#include "base/strings/stringprintf.h"
 #include "base/values.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -342,5 +344,51 @@ TEST_F(JSONParserTest, ReplaceInvalidCharacters) {
   EXPECT_EQ(kUnicodeReplacementString, str);
 }
 
+TEST_F(JSONParserTest, ParseNumberErrors) {
+  const struct {
+    const char* input;
+    bool parse_success;
+    double value;
+  } kCases[] = {
+      // clang-format off
+      {"1", true, 1},
+      {"2.", false, 0},
+      {"42", true, 42},
+      {"6e", false, 0},
+      {"43e2", true, 4300},
+      {"43e-", false, 0},
+      {"9e-3", true, 0.009},
+      {"2e+", false, 0},
+      {"2e+2", true, 200},
+      // clang-format on
+  };
+
+  for (unsigned int i = 0; i < arraysize(kCases); ++i) {
+    auto test_case = kCases[i];
+    SCOPED_TRACE(StringPrintf("case %u: \"%s\"", i, test_case.input));
+
+    // MSan will do a better job detecting over-read errors if the input is
+    // not nul-terminated on the heap.
+    size_t str_len = strlen(test_case.input);
+    auto non_nul_termianted = MakeUnique<char[]>(str_len);
+    memcpy(non_nul_termianted.get(), test_case.input, str_len);
+
+    StringPiece string_piece(non_nul_termianted.get(), str_len);
+    std::unique_ptr<Value> result = JSONReader::Read(string_piece);
+    if (test_case.parse_success) {
+      EXPECT_TRUE(result);
+    } else {
+      EXPECT_FALSE(result);
+    }
+
+    if (!result)
+      continue;
+
+    double double_value = 0;
+    EXPECT_TRUE(result->GetAsDouble(&double_value));
+    EXPECT_EQ(test_case.value, double_value);
+  }
+}
+
 }  // namespace internal
 }  // namespace base