Ensure ClipboardWin::ReadHTML does not crash on embedded nulls

ui/base/clipboard/clipboard_win.cc

Index: ui/base/clipboard/clipboard_win.cc
diff --git a/ui/base/clipboard/clipboard_win.cc b/ui/base/clipboard/clipboard_win.cc
index ae892c9c0faa8b985aaeb342fb0e018fd5b852e4..f1c7c038a5083de2cd4f8b84908ca7a4fe9b8a20 100644
--- a/ui/base/clipboard/clipboard_win.cc
+++ b/ui/base/clipboard/clipboard_win.cc
@@ -568,8 +568,10 @@ void ClipboardWin::ReadHTML(ClipboardType type,
   offsets.push_back(end_index - html_start);
   markup->assign(base::UTF8ToUTF16AndAdjustOffsets(cf_html.data() + html_start,
                                                    &offsets));
-  *fragment_start = base::checked_cast<uint32_t>(offsets[0]);
-  *fragment_end = base::checked_cast<uint32_t>(offsets[1]);
+  // Ensure the Fragment points within the string; see https://crbug.com/607181.
+  size_t end = std::min(offsets[1], markup->length());
+  *fragment_start = base::checked_cast<uint32_t>(std::min(offsets[0], end));
+  *fragment_end = base::checked_cast<uint32_t>(end);
 }
 
 void ClipboardWin::ReadRTF(ClipboardType type, std::string* result) const {