Ensure ClipboardWin::ReadHTML does not crash on embedded nulls

ui/base/clipboard/clipboard_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Many of these functions are based on those found in
 // webkit/port/platform/PasteboardWin.cpp
 
 #include "ui/base/clipboard/clipboard_win.h"
 
 #include <shellapi.h>
@@ skipping 550 matching lines @@
     return;
 
   if (start_index < html_start || end_index < start_index)
     return;
 
   std::vector<size_t> offsets;
   offsets.push_back(start_index - html_start);
   offsets.push_back(end_index - html_start);
   markup->assign(base::UTF8ToUTF16AndAdjustOffsets(cf_html.data() + html_start,
                                                    &offsets));
-  *fragment_start = base::checked_cast<uint32_t>(offsets[0]);
-  *fragment_end = base::checked_cast<uint32_t>(offsets[1]);
+  // Ensure the Fragment points within the string; see https://crbug.com/607181.
+  size_t markup_end = markup->length();
+  if (markup_end > 0)
+    markup_end--;

[dcheng, 2017/04/26 00:42:08]

Why do we need to adjust this? Microsoft's examples seem to be unclear and
incomplete, but
https://cs.chromium.org/chromium/src/ui/base/clipboard/clipboard_util_win.cc?...
seems to imply that start/end indexes might work like we would expect them to.

[elawrence, 2017/04/26 15:11:22]

Indeed, testing indicates that the indexes do work like you've described,
although this isn't what I expected. :) 

+  *fragment_end =
+      base::checked_cast<uint32_t>(std::min(offsets[1], markup_end));
+  *fragment_start =
+      std::min(*fragment_end,
+               base::checked_cast<uint32_t>(std::min(offsets[0], markup_end)));
 }
 
 void ClipboardWin::ReadRTF(ClipboardType type, std::string* result) const {
   DCHECK_EQ(type, CLIPBOARD_TYPE_COPY_PASTE);
 
   ReadData(GetRtfFormatType(), result);
 }
 
 SkBitmap ClipboardWin::ReadImage(ClipboardType type) const {
   DCHECK_EQ(type, CLIPBOARD_TYPE_COPY_PASTE);
@@ skipping 315 matching lines @@
   if (!clipboard_owner_)
     return NULL;
 
   if (clipboard_owner_->hwnd() == NULL)
     clipboard_owner_->Create(base::Bind(&ClipboardOwnerWndProc));
 
   return clipboard_owner_->hwnd();
 }
 
 }  // namespace ui