Fix buffer overflow due to unbounded strlen over a non-null terminated string. Detected by asan.

extensions/browser/api/cast_channel/cast_auth_util.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/browser/api/cast_channel/cast_auth_util.h"
 
 #include <vector>
 
 #include "base/logging.h"
 #include "base/strings/string_number_conversions.h"
@@ skipping 119 matching lines @@
   if (!result.success()) {
     return result;
   }
 
   const AuthResponse& response = auth_message.response();
   result = VerifyCredentials(response, peer_cert);
   if (!result.success()) {
     return result;
   }
 
-  if (response.client_auth_certificate().find(reinterpret_cast<const char*>(
-          kAudioOnlyPolicy)) != std::string::npos) {
+  std::string audio_policy =

[mark a. foltz, 2015/01/30 00:22:42]

const std::string& 

[Kevin M, 2015/01/30 22:15:47]

I didn't know this was legal. Cool.

+      std::string(reinterpret_cast<const char*>(kAudioOnlyPolicy),
+                  (arraysize(kAudioOnlyPolicy) / sizeof(unsigned char)));
+  if (response.client_auth_certificate().find(audio_policy) !=
+      std::string::npos) {
     result.channel_policies |= AuthResult::POLICY_AUDIO_ONLY;
   }
 
   return result;
 }
 
 // This function does the following
 // * Verifies that the trusted CA |response.intermediate_certificate| is
 //   whitelisted for use.
 // * Verifies that |response.client_auth_certificate| is signed
@@ skipping 14 matching lines @@
   if (ret.Success())
     ret = verification_context->VerifySignatureOverData(response.signature(),
                                                         peer_cert);
 
   return TranslateVerificationResult(ret);
 }
 
 }  // namespace cast_channel
 }  // namespace core_api
 }  // namespace extensions