Ensure ClipboardWin::ReadHTML does not crash on embedded nulls

ui/base/clipboard/clipboard_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Many of these functions are based on those found in
 // webkit/port/platform/PasteboardWin.cpp
 
 #include "ui/base/clipboard/clipboard_win.h"
 
 #include <shellapi.h>
@@ skipping 550 matching lines @@
     return;
 
   if (start_index < html_start || end_index < start_index)
     return;
 
   std::vector<size_t> offsets;
   offsets.push_back(start_index - html_start);
   offsets.push_back(end_index - html_start);
   markup->assign(base::UTF8ToUTF16AndAdjustOffsets(cf_html.data() + html_start,
                                                    &offsets));
-  *fragment_start = base::checked_cast<uint32_t>(offsets[0]);
-  *fragment_end = base::checked_cast<uint32_t>(offsets[1]);
+  // Ensure the Fragment points within the string; see https://crbug.com/607181.
+  size_t end = std::min(offsets[1], markup->length());
+  *fragment_start = base::checked_cast<uint32_t>(std::min(offsets[0], end));
+  *fragment_end = base::checked_cast<uint32_t>(end);
 }
 
 void ClipboardWin::ReadRTF(ClipboardType type, std::string* result) const {
   DCHECK_EQ(type, CLIPBOARD_TYPE_COPY_PASTE);
 
   ReadData(GetRtfFormatType(), result);
 }
 
 SkBitmap ClipboardWin::ReadImage(ClipboardType type) const {
   DCHECK_EQ(type, CLIPBOARD_TYPE_COPY_PASTE);
@@ skipping 315 matching lines @@
   if (!clipboard_owner_)
     return NULL;
 
   if (clipboard_owner_->hwnd() == NULL)
     clipboard_owner_->Create(base::Bind(&ClipboardOwnerWndProc));
 
   return clipboard_owner_->hwnd();
 }
 
 }  // namespace ui