Fix buffer overrun in Bluetooth LE code.

device/bluetooth/bluetooth_low_energy_win.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "device/bluetooth/bluetooth_low_energy_win.h"
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/win/windows_version.h"
@@ skipping 112 matching lines @@
   return true;
 }
 
 // Represents a device registry property value
 class DeviceRegistryPropertyValue {
  public:
   static scoped_ptr<DeviceRegistryPropertyValue>
   Create(DWORD property_type, scoped_ptr<UINT8[]> value, size_t value_size) {
     if (property_type == REG_SZ) {
       // Ensure string is zero terminated.
-      CHECK_GE(value_size, 1u);
+      size_t character_size = value_size / sizeof(WCHAR);
+      CHECK_EQ(character_size * sizeof(WCHAR), value_size);
+      CHECK_GE(character_size, 1u);
       WCHAR* value_string = reinterpret_cast<WCHAR*>(value.get());
-      value_string[value_size - 1] = 0;
+      value_string[character_size - 1] = 0;
     }
     return scoped_ptr<DeviceRegistryPropertyValue>(
         new DeviceRegistryPropertyValue(
             property_type, value.Pass(), value_size));
   }
 
   bool AsString(std::string* value, std::string* error) {
     if (property_type_ != REG_SZ) {
       *error = "Property is not a string";
       return false;
@@ skipping 77 matching lines @@
                                        &required_length);
   if (!CheckSuccess(!!success, kDeviceInfoError, error))
     return false;
   if (!CheckExpectedLength(
           actual_length, required_length, kDeviceInfoError, error)) {
     return false;
   }
 
   if (actual_length >= 1) {
     // Ensure string is zero terminated.
     instance_id.get()[actual_length - 1] = 0;

[xiyuan, 2014/07/08 23:26:33]

Would this have similar problem since |instance_id| is WCHAR* and
|actual_length| is in bytes?

[rpaquay, 2014/07/08 23:51:13]

I don't believe so. The msdn doc mentions that the last 2 parameters are
expressed in "number of characters":
http://msdn.microsoft.com/en-us/library/windows/hardware/ff551106(v=vs.85).aspx

     device_info->id = base::SysWideToUTF8(instance_id.get());
   }
   return true;
 }
 
 bool CollectDeviceFriendlyName(
     const ScopedDeviceInfoSetHandle& device_info_handle,
     PSP_DEVINFO_DATA device_info_data,
     scoped_ptr<device::win::BluetoothLowEnergyDeviceInfo>& device_info,
     std::string* error) {
@@ skipping 210 matching lines @@
 
 bool ExtractBluetoothAddressFromDeviceInstanceIdForTesting(
     const std::string& instance_id,
     BLUETOOTH_ADDRESS* btha,
     std::string* error) {
   return ExtractBluetoothAddressFromDeviceInstanceId(instance_id, btha, error);
 }
 
 }  // namespace win
 }  // namespace device