Do not read past the end of the string in net::SniffXML().

net/base/mime_sniffer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Detecting mime types is a tricky business because we need to balance
 // compatibility concerns with security issues.  Here is a survey of how other
 // browsers behave and then a description of how we intend to behave.
 //
 // HTML payload, no Content-Type header:
 // * IE 7: Render as HTML
@@ skipping 594 matching lines @@
   if (!counter) {
     counter = UMASnifferHistogramGet("mime_sniffer.kMagicXML2",
                                      arraysize(kMagicXML));
   }
   const int kMaxTagIterations = 5;
   for (int i = 0; i < kMaxTagIterations && pos < end; ++i) {
     pos = reinterpret_cast<const char*>(memchr(pos, '<', end - pos));
     if (!pos)
       return false;
 
-    if (base::strncasecmp(pos, "<?xml", sizeof("<?xml") - 1) == 0) {
+    if ((pos + sizeof("<?xml") - 1 <= end) &&
+        (base::strncasecmp(pos, "<?xml", sizeof("<?xml") - 1) == 0)) {
       // Skip XML declarations.
       ++pos;
       continue;
-    } else if (base::strncasecmp(pos, "<!DOCTYPE",
-                                 sizeof("<!DOCTYPE") - 1) == 0) {
+    } else if ((pos + sizeof("<!DOCTYPE") - 1 <= end) &&
+               (base::strncasecmp(pos, "<!DOCTYPE", sizeof("<!DOCTYPE") - 1) ==
+                0)) {
       // Skip DOCTYPE declarations.
       ++pos;
       continue;
     }
 
     if (CheckForMagicNumbers(pos, end - pos,
                              kMagicXML, arraysize(kMagicXML),
                              counter, result))
       return true;
 
@@ skipping 330 matching lines @@
   // First check the extra table.
   if (CheckForMagicNumbers(content, size, kExtraMagicNumbers,
                            arraysize(kExtraMagicNumbers), NULL, result))
     return true;
   // Finally check the original table.
   return CheckForMagicNumbers(content, size, kMagicNumbers,
                               arraysize(kMagicNumbers), NULL, result);
 }
 
 }  // namespace net