Fix: Make DoCanonicalizeIPv6Address safer by changing loop condition and addi...

src/url_canon_ip.cc

 // Copyright 2007, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 622 matching lines @@
   host_info->out_host.begin = output->length();
   output->push_back('[');
 
   // We will now output the address according to the rules in:
   // http://tools.ietf.org/html/draft-kawamura-ipv6-text-representation-01#section-4
 
   // Start by finding where to place the "::" contraction (if any).
   url_parse::Component contraction_range;
   ChooseIPv6ContractionRange(address, &contraction_range);
 
-  for (int i = 0; i < 16;) {
+  for (int i = 0; i <= 14;) {
+    // We check 2 bytes at a time, from bytes (0, 1) to (14, 15), inclusive.
+    DCHECK(i % 2 == 0);
     if (i == contraction_range.begin && contraction_range.len > 0) {
       // Jump over the contraction.
       if (i == 0)
         output->push_back(':');
       output->push_back(':');
       i = contraction_range.end();
     } else {
       // Consume the next 16 bits from |address|.
       int x = address[i] << 8 | address[i + 1];
 
@@ skipping 50 matching lines @@
                            CanonHostInfo* host_info) {
   if (DoCanonicalizeIPv4Address<char16, char16>(
           spec, host, output, host_info))
     return;
   if (DoCanonicalizeIPv6Address<char16, char16>(
           spec, host, output, host_info))
     return;
 }
 
 }  // namespace url_canon