Update from https://crrev.com/306655

net/cert/crl_set_storage.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/crl_set_storage.h"
 
 #include "base/base64.h"
 #include "base/debug/trace_event.h"
 #include "base/format_macros.h"
 #include "base/json/json_reader.h"
+#include "base/numerics/safe_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/values.h"
 #include "crypto/sha2.h"
 #include "third_party/zlib/zlib.h"
 
 namespace net {
 
 // Decompress zlib decompressed |in| into |out|. |out_len| is the number of
 // bytes at |out| and must be exactly equal to the size of the decompressed
 // data.
@@ skipping 489 matching lines @@
   for (CRLSet::CRLList::const_iterator i = crl_set->crls_.begin();
        i != crl_set->crls_.end(); ++i) {
     len += i->first.size() + 4 /* num serials */;
     for (std::vector<std::string>::const_iterator j = i->second.begin();
          j != i->second.end(); ++j) {
       len += 1 /* serial length */ + j->size();
     }
   }
 
   std::string ret;
-  char* out = WriteInto(&ret, len + 1 /* to include final NUL */);
+  uint8_t* out = reinterpret_cast<uint8_t*>(
+      WriteInto(&ret, len + 1 /* to include final NUL */));
   size_t off = 0;
-  out[off++] = header.size();
-  out[off++] = header.size() >> 8;
+  CHECK(base::IsValueInRangeForNumericType<uint16>(header.size()));
+  out[off++] = static_cast<uint8_t>(header.size());
+  out[off++] = static_cast<uint8_t>(header.size() >> 8);
   memcpy(out + off, header.data(), header.size());
   off += header.size();
 
   for (CRLSet::CRLList::const_iterator i = crl_set->crls_.begin();
        i != crl_set->crls_.end(); ++i) {
     memcpy(out + off, i->first.data(), i->first.size());
     off += i->first.size();
     const uint32 num_serials = i->second.size();
     memcpy(out + off, &num_serials, sizeof(num_serials));
     off += sizeof(num_serials);
 
     for (std::vector<std::string>::const_iterator j = i->second.begin();
          j != i->second.end(); ++j) {
-      out[off++] = j->size();
+      CHECK(base::IsValueInRangeForNumericType<uint8_t>(j->size()));
+      out[off++] = static_cast<uint8_t>(j->size());
       memcpy(out + off, j->data(), j->size());
       off += j->size();
     }
   }
 
   CHECK_EQ(off, len);
   return ret;
 }
 
 }  // namespace net