Add unit tests for NTLMv1 portable implementation

net/http/http_auth_handler_ntlm_portable.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_auth_handler_ntlm.h"
 
 #include <stdlib.h>
 // For gethostname
 #if defined(OS_POSIX)
 #include <unistd.h>
@@ skipping 392 matching lines @@
   if (memcmp(cursor, NTLM_TYPE2_MARKER, sizeof(NTLM_TYPE2_MARKER)) != 0)
     return ERR_UNEXPECTED;
   cursor += sizeof(NTLM_TYPE2_MARKER);
 
   // read target name security buffer
   uint32_t target_len = ReadUint16(cursor);
   ReadUint16(cursor);  // discard next 16-bit value
   uint32_t offset = ReadUint32(cursor);  // get offset from in_buf
   msg->target_len = 0;
   msg->target = NULL;
-  // Check the offset / length combo is in range of the input buffer, including
-  // integer overflow checking.
-  if (offset + target_len > offset && offset + target_len <= in_len) {
-    msg->target_len = target_len;
-    msg->target = ((const uint8_t*)in_buf) + offset;
+
+  // Target length 0 is valid and indicates no target information.
+  if (target_len != 0) {
+    // Check the offset / length combo is in range of the input buffer,
+    // including integer overflow checking.
+    if (offset + target_len > offset && offset + target_len <= in_len) {
+      msg->target_len = target_len;
+      msg->target = ((const uint8_t*)in_buf) + offset;
+    } else {
+      // Reject a message with a non-zero target length that
+      // would cause an overflow.
+      return ERR_UNEXPECTED;
+    }
   }
 
   // read flags
   msg->flags = ReadUint32(cursor);
 
   // read challenge
   memcpy(msg->challenge, cursor, sizeof(msg->challenge));
   cursor += sizeof(msg->challenge);
 
   NTLM_LOG(("NTLM type 2 message:\n"));
@@ skipping 300 matching lines @@
   // of NTLM.
   std::unique_ptr<HttpAuthHandler> tmp_handler(new HttpAuthHandlerNTLM);
   if (!tmp_handler->InitFromChallenge(challenge, target, ssl_info, origin,
                                       net_log))
     return ERR_INVALID_RESPONSE;
   handler->swap(tmp_handler);
   return OK;
 }
 
 }  // namespace net