Fixing a crash in disk_cache::SparseControl::UpdateRange()

TEST=net_unittests --gtest_filter=DiskCacheEntryTest::PArtialSparseEntry

If we do a partial write with the following criteria, disk_cache::SparseControl
will crash:

1. first_byte and last_byte in the same 1KB block
2. first_byte % 1024 != 0
3. (first_byte >> 10) % 32 == 31

Review URL: http://codereview.chromium.org/176067

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@25134 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 7 insertions, 0 deletions

diff --git a/net/disk_cache/sparse_control.cc b/net/disk_cache/sparse_control.cc
index 66096a2..d2e66d9 100644
--- a/net/disk_cache/sparse_control.cc
+++ b/net/disk_cache/sparse_control.cc
@@ -506,6 +506,13 @@ void SparseControl::UpdateRange(int result) {
   int last_bit = (child_offset_ + result) >> 10;
   block_offset = (child_offset_ + result) & (kBlockSize - 1);
 
+  // This condition will hit with the following criteria:
+  // 1. The first byte doesn't follow the last write.
+  // 2. The first byte is in the middle of a block.
+  // 3. The first byte and the last byte are in the same block.
+  if (first_bit > last_bit)
+    return;
+
   if (block_offset && !child_map_.Get(last_bit)) {
     // The last block is not completely filled; save it for later.
     child_data_.header.last_block = last_bit;