Fix buffer overflow due to unbounded strlen over a non-null terminated string. Detected by asan.

extensions/browser/api/cast_channel/cast_auth_util.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/cast_channel/cast_auth_util.h"
 
 #include <vector>
 
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "extensions/browser/api/cast_channel/cast_message_util.h"
 #include "extensions/common/api/cast_channel/cast_channel.pb.h"
 #include "extensions/common/cast/cast_cert_validator.h"
 
 namespace extensions {
 namespace core_api {
 namespace cast_channel {
 namespace {
 
 const char* const kParseErrorPrefix = "Failed to parse auth message: ";
 
-const unsigned char kAudioOnlyPolicy[] =
+const char kAudioOnlyPolicy[] =

[mark a. foltz, 2015/01/29 19:43:08]

This has to remain unsigned right?  It breaks compilation on Windows.

FAILED: ninja -t msvc -e environment.x86 -- E:\b\build\goma/gomacc
"E:\b\depot_tools\win_toolchain\vs2013_files\VC\bin\amd64_x86\cl.exe" /nologo
/showIncludes /FC
@obj\extensions\browser\api\cast_channel\extensions_browser.cast_auth_util.obj.rsp
/c ..\..\extensions\browser\api\cast_channel\cast_auth_util.cc
/Foobj\extensions\browser\api\cast_channel\extensions_browser.cast_auth_util.obj
/Fdobj\extensions\extensions_browser.cc.pdb 
e:\b\build\slave\win\build\src\extensions\browser\api\cast_channel\cast_auth_util.cc(24)
: error C2220: warning treated as error - no 'object' file generated
e:\b\build\slave\win\build\src\extensions\browser\api\cast_channel\cast_auth_util.cc(24)
: warning C4309: 'initializing' : truncation of constant value
ninja: build stopped: subcommand failed.

[Kevin M, 2015/01/30 00:11:10]

Done.

     {0x06, 0x0A, 0x2B, 0x06, 0x01, 0x04, 0x01, 0xD6, 0x79, 0x02, 0x05, 0x02};
 
 namespace cast_crypto = ::extensions::core_api::cast_crypto;
 
 // Extracts an embedded DeviceAuthMessage payload from an auth challenge reply
 // message.
 AuthResult ParseAuthMessage(const CastMessage& challenge_reply,
                             DeviceAuthMessage* auth_message) {
   if (challenge_reply.payload_type() != CastMessage_PayloadType_BINARY) {
     return AuthResult::CreateWithParseError(
@@ skipping 96 matching lines @@
   if (!result.success()) {
     return result;
   }
 
   const AuthResponse& response = auth_message.response();
   result = VerifyCredentials(response, peer_cert);
   if (!result.success()) {
     return result;
   }
 
-  if (response.client_auth_certificate().find(reinterpret_cast<const char*>(
-          kAudioOnlyPolicy)) != std::string::npos) {
+  if (response.client_auth_certificate().find(std::string(

[mark a. foltz, 2015/01/29 19:43:08]

For readability, consider declaring a separate const std::string& audioPolicy. 
Don't feel strongly though.

[Kevin M, 2015/01/30 00:11:10]

Done.

+          kAudioOnlyPolicy, (arraysize(kAudioOnlyPolicy) /

[mark a. foltz, 2015/01/29 19:43:08]

Extra ()

[Kevin M, 2015/01/30 00:11:10]

Done.

+                             sizeof(unsigned char)))) != std::string::npos) {
     result.channel_policies |= AuthResult::POLICY_AUDIO_ONLY;
   }
 
   return result;
 }
 
 // This function does the following
 // * Verifies that the trusted CA |response.intermediate_certificate| is
 //   whitelisted for use.
 // * Verifies that |response.client_auth_certificate| is signed
@@ skipping 14 matching lines @@
   if (ret.Success())
     ret = verification_context->VerifySignatureOverData(response.signature(),
                                                         peer_cert);
 
   return TranslateVerificationResult(ret);
 }
 
 }  // namespace cast_channel
 }  // namespace core_api
 }  // namespace extensions