Fix: Make DoCanonicalizeIPv6Address safer by changing loop condition and addi...

src/url_canon_ip.cc

Index: src/url_canon_ip.cc
===================================================================
--- src/url_canon_ip.cc	(revision 107)
+++ src/url_canon_ip.cc	(working copy)
@@ -640,7 +640,9 @@
   url_parse::Component contraction_range;
   ChooseIPv6ContractionRange(address, &contraction_range);
 
-  for (int i = 0; i < 16;) {
+  for (int i = 0; i <= 14;) {
+    // We check 2 bytes at a time, from bytes (0, 1) to (14, 15), inclusive.
+    DCHECK(i % 2 == 0);
     if (i == contraction_range.begin && contraction_range.len > 0) {
       // Jump over the contraction.
       if (i == 0)