CSP: Harden hash parsing.

Source/core/frame/csp/CSPSourceList.cpp

Index: Source/core/frame/csp/CSPSourceList.cpp
diff --git a/Source/core/frame/csp/CSPSourceList.cpp b/Source/core/frame/csp/CSPSourceList.cpp
index da259835b8b1e68e184baf290e714b7a7406ade8..0241d43eca8d977944b2bc06126155e75b50fb50 100644
--- a/Source/core/frame/csp/CSPSourceList.cpp
+++ b/Source/core/frame/csp/CSPSourceList.cpp
@@ -298,17 +298,12 @@ bool CSPSourceList::parseHash(const UChar* begin, const UChar* end, DigestValue&
 
     String prefix;
     hashAlgorithm = ContentSecurityPolicyHashAlgorithmNone;
+    size_t hashLength = end - begin;
 
-    // Instead of this sizeof() calculation to get the length of this array,
-    // it would be preferable to use WTF_ARRAY_LENGTH for simplicity and to
-    // guarantee a compile time calculation. Unfortunately, on some
-    // compliers, the call to WTF_ARRAY_LENGTH fails on arrays of anonymous
-    // stucts, so, for now, it is necessary to resort to this sizeof
-    // calculation.
-    for (size_t i = 0; i < (sizeof(kSupportedPrefixes) / sizeof(kSupportedPrefixes[0])); i++) {
-        if (equalIgnoringCase(kSupportedPrefixes[i].prefix, begin, strlen(kSupportedPrefixes[i].prefix))) {
-            prefix = kSupportedPrefixes[i].prefix;
-            hashAlgorithm = kSupportedPrefixes[i].algorithm;
+    for (const auto& algorithm : kSupportedPrefixes) {

[jww, 2014/11/03 21:16:55]

nit: Calling this 'algorithm' is confusing given that the member is called
algorithm as well. Maybe rename to something like 'algorithmMap' or 'prefixMap'?

+        if (hashLength > strlen(algorithm.prefix) && equalIgnoringCase(algorithm.prefix, begin, strlen(algorithm.prefix))) {
+            prefix = algorithm.prefix;
+            hashAlgorithm = algorithm.algorithm;
             break;
         }
     }
@@ -319,14 +314,17 @@ bool CSPSourceList::parseHash(const UChar* begin, const UChar* end, DigestValue&
     const UChar* position = begin + prefix.length();
     const UChar* hashBegin = position;
 
+    ASSERT(position < end);
     skipWhile<UChar, isBase64EncodedCharacter>(position, end);
     ASSERT(hashBegin <= position);
 
     // Base64 encodings may end with exactly one or two '=' characters
-    skipExactly<UChar>(position, position + 1, '=');
-    skipExactly<UChar>(position, position + 1, '=');
+    if (position < end)
+        skipExactly<UChar>(position, position + 1, '=');
+    if (position < end)
+        skipExactly<UChar>(position, position + 1, '=');
 
-    if ((position + 1) != end || *position != '\'' || !(position - hashBegin))
+    if (position + 1 != end || *position != '\'' || position == hashBegin)
         return false;
 
     Vector<char> hashVector;