A large Content-Length header followed by a connection close could trigger an...

net/http/http_stream_parser.cc

Index: net/http/http_stream_parser.cc
===================================================================
--- net/http/http_stream_parser.cc	(revision 32544)
+++ net/http/http_stream_parser.cc	(working copy)
@@ -84,6 +84,7 @@
   DCHECK(io_state_ == STATE_BODY_PENDING || io_state_ == STATE_DONE);
   DCHECK(!user_callback_);
   DCHECK(callback);
+  DCHECK_LE(buf_len, kMaxHeaderBufSize);
 
   if (io_state_ == STATE_DONE)
     return OK;
@@ -373,15 +374,15 @@
     if (chunked_decoder_.get()) {
       save_amount = chunked_decoder_->bytes_after_eof();
     } else if (response_body_length_ >= 0) {
-      save_amount = static_cast<int>(response_body_read_ -
-                                     response_body_length_);
-      if (save_amount < 0)
-        save_amount = 0;
-
-      if (result > 0)
-        result -= save_amount;
+      int64 extra_data_read = response_body_read_ - response_body_length_;
+      if (extra_data_read > 0) {
+        save_amount = static_cast<int>(extra_data_read);
+        if (result > 0)
+          result -= save_amount;
+      }
     }
 
+    CHECK(save_amount + additional_save_amount <= kMaxHeaderBufSize);
     if (read_buf_->capacity() < save_amount + additional_save_amount) {
       read_buf_->SetCapacity(save_amount + additional_save_amount);
     }