Ensure ClipboardWin::ReadHTML does not crash on embedded nulls

ui/base/clipboard/clipboard_win.cc

Index: ui/base/clipboard/clipboard_win.cc
diff --git a/ui/base/clipboard/clipboard_win.cc b/ui/base/clipboard/clipboard_win.cc
index ae892c9c0faa8b985aaeb342fb0e018fd5b852e4..297d3095d44012ba0a7e943cd2ed3586387c432a 100644
--- a/ui/base/clipboard/clipboard_win.cc
+++ b/ui/base/clipboard/clipboard_win.cc
@@ -568,8 +568,15 @@ void ClipboardWin::ReadHTML(ClipboardType type,
   offsets.push_back(end_index - html_start);
   markup->assign(base::UTF8ToUTF16AndAdjustOffsets(cf_html.data() + html_start,
                                                    &offsets));
-  *fragment_start = base::checked_cast<uint32_t>(offsets[0]);
-  *fragment_end = base::checked_cast<uint32_t>(offsets[1]);
+  // Ensure the Fragment points within the string; see https://crbug.com/607181.
+  size_t markup_end = markup->length();
+  if (markup_end > 0)
+    markup_end--;

[dcheng, 2017/04/26 00:42:08]

Why do we need to adjust this? Microsoft's examples seem to be unclear and
incomplete, but
https://cs.chromium.org/chromium/src/ui/base/clipboard/clipboard_util_win.cc?...
seems to imply that start/end indexes might work like we would expect them to.

[elawrence, 2017/04/26 15:11:22]

Indeed, testing indicates that the indexes do work like you've described,
although this isn't what I expected. :) 

+  *fragment_end =
+      base::checked_cast<uint32_t>(std::min(offsets[1], markup_end));
+  *fragment_start =
+      std::min(*fragment_end,
+               base::checked_cast<uint32_t>(std::min(offsets[0], markup_end)));
 }
 
 void ClipboardWin::ReadRTF(ClipboardType type, std::string* result) const {