Ensure ClipboardWin::ReadHTML does not crash on embedded nulls

ui/base/clipboard/clipboard_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Many of these functions are based on those found in
 // webkit/port/platform/PasteboardWin.cpp
 
 #include "ui/base/clipboard/clipboard_win.h"
 
 #include <shellapi.h>
@@ skipping 551 matching lines @@
 
   if (start_index < html_start || end_index < start_index)
     return;
 
   std::vector<size_t> offsets;
   offsets.push_back(start_index - html_start);
   offsets.push_back(end_index - html_start);
   markup->assign(base::UTF8ToUTF16AndAdjustOffsets(cf_html.data() + html_start,
                                                    &offsets));
   *fragment_start = base::checked_cast<uint32_t>(offsets[0]);
-  *fragment_end = base::checked_cast<uint32_t>(offsets[1]);
+
+  // Ensure EndFragment points within the string; see https://crbug.com/607181.
+  *fragment_end =
+      base::checked_cast<uint32_t>(std::min(offsets[1], markup->length()));

[dcheng, 2017/04/22 08:25:25]

Should we do this for offsets[0] as well?

[elawrence, 2017/04/25 16:20:19]

Embedded nulls (the known repro case) aren't problematic for the fragment_start
value, but in the case of a very malformed CF_HTML, it's certainly possible that
the StartFragment index on the clipboard points outside of
GlobalSize(data)/EndHTML.

To address that, I'll ensure final fragment_start value is <= fragment_end.

[dcheng, 2017/04/26 00:42:08]

Why can't embedded nulls appear before fragment start?

[elawrence, 2017/04/26 15:11:22]

Ah, you're right in the general case. In the case of the client I've been using,
the fragment always contains the entire markup. 

 }
 
 void ClipboardWin::ReadRTF(ClipboardType type, std::string* result) const {
   DCHECK_EQ(type, CLIPBOARD_TYPE_COPY_PASTE);
 
   ReadData(GetRtfFormatType(), result);
 }
 
 SkBitmap ClipboardWin::ReadImage(ClipboardType type) const {
   DCHECK_EQ(type, CLIPBOARD_TYPE_COPY_PASTE);
@@ skipping 315 matching lines @@
   if (!clipboard_owner_)
     return NULL;
 
   if (clipboard_owner_->hwnd() == NULL)
     clipboard_owner_->Create(base::Bind(&ClipboardOwnerWndProc));
 
   return clipboard_owner_->hwnd();
 }
 
 }  // namespace ui