Fix control port string overflow

components/tor/tor_file_watcher.cc

@@ -238,20 +238,24 @@ bool TorFileWatcher::EatControlPort(int& port, base::Time& mtime) {
   }
 
   // Read up to 27/28 octets, the maximum we will ever need.
-  const size_t kBufSiz = strlen(kControlPortMaxTmpl);
+  const size_t kBufSiz = sizeof(kControlPortMaxTmpl);
   char buf[kBufSiz];
   int nread = portfile.ReadAtCurrentPos(buf, sizeof buf);
   if (nread < 0) {
     VLOG(0) << "tor: failed to read control port";
     return false;
+  } else if (static_cast<size_t>(nread) >= sizeof buf) {
+    VLOG(0) << "tor: control port too long";
+    return false;
   }
+
   if (static_cast<size_t>(nread) < strlen(kControlPortMinTmpl)) {
     VLOG(0) << "tor: control port truncated";
     return false;
   }
-  DCHECK(static_cast<size_t>(nread) <= sizeof buf);
 
-  std::string text(buf, 0, nread);
+  buf[nread] = '\0';
+  std::string text(buf);
 
   // Sanity-check the content.
   if (!base::StartsWith(text, "PORT=", base::CompareCase::SENSITIVE) ||

components/tor/tor_file_watcher_unittest.cc

@@ -33,6 +33,12 @@ constexpr char kControlportTooLong[] =
 #else
     "controlport_too_long";
 #endif
+constexpr char kControlportMax[] =
+#if defined(OS_WIN)
+    "controlport_max_win";
+#else
+    "controlport_max";
+#endif
 constexpr char kControlportOverflow[] =
 #if defined(OS_WIN)
     "controlport_overflow_win";
@@ -165,6 +171,13 @@ TEST_F(TorFileWatcherTest, EatControlPort) {
   EXPECT_EQ(port, -1);
   EXPECT_EQ(time.ToJsTime(), 0u);
 
+  tor_file_watcher.reset(
+      new TorFileWatcher(test_data_dir().AppendASCII(kControlportMax)));
+  tor_file_watcher->polling_ = true;
+  EXPECT_FALSE(tor_file_watcher->EatControlPort(port, time));
+  EXPECT_EQ(port, -1);
+  EXPECT_EQ(time.ToJsTime(), 0u);
+
   tor_file_watcher.reset(
       new TorFileWatcher(test_data_dir().AppendASCII(kControlportTooLong)));
   tor_file_watcher->polling_ = true;

test/data/tor/tor_control/controlport_max/controlport

@@ -0,0 +1 @@
+PORT=255.255.255.255:65535

test/data/tor/tor_control/controlport_max_win/controlport

@@ -0,0 +1 @@
+PORT=255.255.255.255:65535