Fix buffer overrun in Bluetooth LE code.

device/bluetooth/bluetooth_low_energy_win.cc

Index: device/bluetooth/bluetooth_low_energy_win.cc
diff --git a/device/bluetooth/bluetooth_low_energy_win.cc b/device/bluetooth/bluetooth_low_energy_win.cc
index 8d1790e5c051a0a9980bc577201550a9996e6972..7a3276fc411499e31db061c139febb5236f96725 100644
--- a/device/bluetooth/bluetooth_low_energy_win.cc
+++ b/device/bluetooth/bluetooth_low_energy_win.cc
@@ -130,9 +130,11 @@ class DeviceRegistryPropertyValue {
   Create(DWORD property_type, scoped_ptr<UINT8[]> value, size_t value_size) {
     if (property_type == REG_SZ) {
       // Ensure string is zero terminated.
-      CHECK_GE(value_size, 1u);
+      size_t character_size = value_size / sizeof(WCHAR);
+      CHECK_EQ(character_size * sizeof(WCHAR), value_size);
+      CHECK_GE(character_size, 1u);
       WCHAR* value_string = reinterpret_cast<WCHAR*>(value.get());
-      value_string[value_size - 1] = 0;
+      value_string[character_size - 1] = 0;
     }
     return scoped_ptr<DeviceRegistryPropertyValue>(
         new DeviceRegistryPropertyValue(