Do not read past the end of the string in net::SniffXML().

net/base/mime_sniffer.cc

Index: net/base/mime_sniffer.cc
diff --git a/net/base/mime_sniffer.cc b/net/base/mime_sniffer.cc
index ef2e27030bb5f642477362def29a683e5ad3a544..61ef948211059db1857f10df3cf5b9386a7eaaf3 100644
--- a/net/base/mime_sniffer.cc
+++ b/net/base/mime_sniffer.cc
@@ -612,12 +612,14 @@ static bool SniffXML(const char* content,
     if (!pos)
       return false;
 
-    if (base::strncasecmp(pos, "<?xml", sizeof("<?xml") - 1) == 0) {
+    if ((pos + sizeof("<?xml") - 1 <= end) &&
+        (base::strncasecmp(pos, "<?xml", sizeof("<?xml") - 1) == 0)) {
       // Skip XML declarations.
       ++pos;
       continue;
-    } else if (base::strncasecmp(pos, "<!DOCTYPE",
-                                 sizeof("<!DOCTYPE") - 1) == 0) {
+    } else if ((pos + sizeof("<!DOCTYPE") - 1 <= end) &&
+               (base::strncasecmp(pos, "<!DOCTYPE", sizeof("<!DOCTYPE") - 1) ==
+                0)) {
       // Skip DOCTYPE declarations.
       ++pos;
       continue;