Replace NT prefix in sandbox rules match string to handle correct wildcard escaping

sandbox/win/src/filesystem_policy.cc

Index: sandbox/win/src/filesystem_policy.cc
diff --git a/sandbox/win/src/filesystem_policy.cc b/sandbox/win/src/filesystem_policy.cc
index 331b9fbe27916d0ad4a36d47cce8769481ba2b8e..87340a8227b866aead19bc86d15c2747012a8f10 100644
--- a/sandbox/win/src/filesystem_policy.cc
+++ b/sandbox/win/src/filesystem_policy.cc
@@ -77,12 +77,9 @@ bool FileSystemPolicy::GenerateRules(const wchar_t* name,
       NOTREACHED();
       return false;
     }
-    if (0 != mod_name.compare(0, kNTPrefixLen, kNTPrefix)) {
-      // TODO(nsylvain): Find a better way to do name resolution. Right now we
-      // take the name and we expand it.
-      mod_name.insert(0, L"\\/?/?\\");
-      name = mod_name.c_str();
-    }
+
+    mod_name = FixNTPrefixForMatch(mod_name);
+    name = mod_name.c_str();
   }
 
   EvalResult result = ASK_BROKER;
@@ -383,4 +380,26 @@ bool PreProcessName(const base::string16& path, base::string16* new_path) {
   return !reparsed;
 }
 
+base::string16 FixNTPrefixForMatch(const base::string16& name) {
+  base::string16 mod_name = name;
+
+  // NT prefix escaped for rule matcher
+  const wchar_t kNTPrefixEscaped[] = L"\\/?/?\\";
+  const int kNTPrefixEscapedLen = arraysize(kNTPrefixEscaped) - 1;
+
+  if (0 != mod_name.compare(0, kNTPrefixLen, kNTPrefix)) {
+    if (0 != mod_name.compare(0, kNTPrefixEscapedLen, kNTPrefixEscaped)) {
+      // TODO(nsylvain): Find a better way to do name resolution. Right now we
+      // take the name and we expand it.
+      mod_name.insert(0, kNTPrefixEscaped);
+    }
+  } else {
+    // Start of name matches NT prefix, replace with escaped format
+    // Fixes bug: 334882

[rvargas (doing something else), 2014/08/16 02:23:17]

nit: we don't generally add bug numbers that are fixed by CLs... that's what
blame is for.

+    mod_name.replace(0, kNTPrefixLen, kNTPrefixEscaped);
+  }
+
+  return mod_name;
+}
+
 }  // namespace sandbox