Address outstanding comments from CL 10384140

remoting/host/me2me_preference_pane.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "remoting/host/me2me_preference_pane.h"
 
 #import <Cocoa/Cocoa.h>
 #include <CommonCrypto/CommonHMAC.h>
 #include <launch.h>
 #import <PreferencePanes/PreferencePanes.h>
@@ skipping 65 matching lines @@
     LOG(ERROR) << "Authentication method '" << method << "' not supported";
     return false;
   }
 
   std::string hash_base64 = host_secret_hash.substr(separator + 1);
 
   // Convert |hash_base64| to |hash|, based on code from base/base64.cc.
   int hash_base64_size = static_cast<int>(hash_base64.size());
   std::string hash;
   hash.resize(modp_b64_decode_len(hash_base64_size));
+
+  // modp_b64_decode_len() returns at least 1, so hash[0] is safe here.
   int hash_size = modp_b64_decode(&(hash[0]), hash_base64.data(),
                                   hash_base64_size);
   if (hash_size < 0) {
     LOG(ERROR) << "Failed to parse host_secret_hash";
     return false;
   }
   hash.resize(hash_size);
 
   std::string computed_hash;
   computed_hash.resize(CC_SHA256_DIGEST_LENGTH);
 
   CCHmac(kCCHmacAlgSHA256,
          host_id.data(), host_id.size(),
          pin.data(), pin.size(),
          &(computed_hash[0]));
 
+  // Normally, a constant-time comparison function would be used, but it is
+  // unnecessary here as the "secret" is already readable by the user
+  // supplying input to this routine.
   return computed_hash == hash;
 }
 
 }  // namespace
 
 namespace remoting {
 JsonHostConfig::JsonHostConfig(const std::string& filename)
     : filename_(filename) {
 }
 
@@ skipping 374 matching lines @@
 - (void)notifyPlugin:(const char*)message {
   NSDistributedNotificationCenter* center =
       [NSDistributedNotificationCenter defaultCenter];
   NSString* name = [NSString stringWithUTF8String:message];
   [center postNotificationName:name
                         object:nil
                       userInfo:nil];
 }
 
 @end