Fix fuzzer crash for preg_parser

Fix fuzzer crash for preg_parser

Preg files with strings containing valid code points, but invalid
characters (e.g. 65535) triggered a DCHECK because base::UTF16ToUTF8
(called from DecodePRegStringValue) accepts invalid characters, but
base::IsStringUTF8 (DCHECK'ed in base::Value) does not. This CL
rejects these invalid strings before putting them into base::Values.
The crash was found in a libfuzzer test.

BUG=714432
TEST=Added and checked test case to verify fix.

Review-Url: https://codereview.chromium.org/2852393002
Cr-Commit-Position: refs/heads/master@{#468704}
Committed: https://chromium.googlesource.com/chromium/src/+/ee7474ea14ebc2764e277fdf03557851c1976038

[ljusten (tachyonic), 2017-05-02 14:31:48]

The CQ bit was checked by ljusten@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-05-02 14:32:40]

Dry run: CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[ljusten (tachyonic), 2017-05-02 15:07:21]

ljusten@chromium.org changed reviewers:
+ tnagel@chromium.org

[ljusten (tachyonic), 2017-05-02 15:07:21]

Thiemo, PTAL.

[Thiemo Nagel, 2017-05-02 15:48:31]

lgtm with option nit

https://codereview.chromium.org/2852393002/diff/1/components/policy/core/comm...
File components/policy/core/common/preg_parser.cc (right):

https://codereview.chromium.org/2852393002/diff/1/components/policy/core/comm...
components/policy/core/common/preg_parser.cc:151: return false;
Optional nit: Maybe clear |*value| as part of the error path to ensure that it
cannot be used inadvertently?

[commit-bot: I haz the power, 2017-05-02 15:52:05]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-05-02 15:52:06]

Dry run: This issue passed the CQ dry run.

[ljusten (tachyonic), 2017-05-02 15:58:32]

Thanks, nit fixed.

https://codereview.chromium.org/2852393002/diff/1/components/policy/core/comm...
File components/policy/core/common/preg_parser.cc (right):

https://codereview.chromium.org/2852393002/diff/1/components/policy/core/comm...
components/policy/core/common/preg_parser.cc:151: return false;
On 2017/05/02 15:48:31, Thiemo Nagel wrote:
> Optional nit: Maybe clear |*value| as part of the error path to ensure that it
> cannot be used inadvertently?

Done.

[ljusten (tachyonic), 2017-05-02 15:58:45]

The CQ bit was checked by ljusten@chromium.org

[ljusten (tachyonic), 2017-05-02 15:58:46]

The patchset sent to the CQ was uploaded after l-g-t-m from tnagel@chromium.org
Link to the patchset: https://codereview.chromium.org/2852393002/#ps20001
(title: "Nit fix.")

[commit-bot: I haz the power, 2017-05-02 15:59:23]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Thiemo Nagel, 2017-05-02 16:05:00]

Thanks!

Still lgtm.

[commit-bot: I haz the power, 2017-05-02 17:51:07]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1493740725847240,
"parent_rev": "ac8799f165a21fcc0b76739cfbd18ac7cb7445b6", "commit_rev":
"ee7474ea14ebc2764e277fdf03557851c1976038"}

[commit-bot: I haz the power, 2017-05-02 17:51:19]

Description was changed from

==========
Fix fuzzer crash for preg_parser

Preg files with strings containing valid code points, but invalid
characters (e.g. 65535) triggered a DCHECK because base::UTF16ToUTF8
(called from DecodePRegStringValue) accepts invalid characters, but
base::IsStringUTF8 (DCHECK'ed in base::Value) does not. This CL
rejects these invalid strings before putting them into base::Values.
The crash was found in a libfuzzer test.

BUG=714432
TEST=Added and checked test case to verify fix.
==========

to

==========
Fix fuzzer crash for preg_parser

Preg files with strings containing valid code points, but invalid
characters (e.g. 65535) triggered a DCHECK because base::UTF16ToUTF8
(called from DecodePRegStringValue) accepts invalid characters, but
base::IsStringUTF8 (DCHECK'ed in base::Value) does not. This CL
rejects these invalid strings before putting them into base::Values.
The crash was found in a libfuzzer test.

BUG=714432
TEST=Added and checked test case to verify fix.

Review-Url: https://codereview.chromium.org/2852393002
Cr-Commit-Position: refs/heads/master@{#468704}
Committed:
https://chromium.googlesource.com/chromium/src/+/ee7474ea14ebc2764e277fdf0355...
==========

[commit-bot: I haz the power, 2017-05-02 17:51:21]

Committed patchset #2 (id:20001) as
https://chromium.googlesource.com/chromium/src/+/ee7474ea14ebc2764e277fdf0355...