Fix a crash when a line with an HTTP chunk length is too long

net/http/http_chunked_decoder.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Derived from:
 //   mozilla/netwerk/protocol/http/src/nsHttpChunkedDecoder.h
 // The license block is:
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ skipping 59 matching lines @@
 //
 // The chunk-size field is a string of hex digits indicating the size of the
 // chunk.  The chunked encoding is ended by any chunk whose size is zero,
 // followed by the trailer, which is terminated by an empty line.
 //
 // NOTE: This implementation does not bother to parse trailers since they are
 // not used on the web.
 //
 class NET_EXPORT_PRIVATE HttpChunkedDecoder {
  public:
+  // The maximum length of |line_buf_| between calls to FilterBuff().
+  // Exposed for tests.
+  static const size_t kMaxLineBufLen;
+
   HttpChunkedDecoder();
 
   // Indicates that a previous call to FilterBuf encountered the final CRLF.
   bool reached_eof() const { return reached_eof_; }
 
   // Returns the number of bytes after the final CRLF.
   int bytes_after_eof() const { return bytes_after_eof_; }
 
   // Called to filter out the chunk markers from buf and to check for end-of-
   // file.  This method modifies |buf| inline if necessary to remove chunk
@@ skipping 29 matching lines @@
   bool reached_eof_;
 
   // The number of unfiltered bytes after the final CRLF, either extraneous
   // data or the first part of the next response in a pipelined stream.
   int bytes_after_eof_;
 };
 
 }  // namespace net
 
 #endif  // NET_HTTP_HTTP_CHUNKED_DECODER_H_