Fix a crash in IP address checking because the boundary case for an empty or ...

src/url_canon_ip.cc

 // Copyright 2009, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 40 matching lines @@
       return 8;
     default:
       return 0;
   }
 }
 
 template<typename CHAR, typename UCHAR>
 bool DoFindIPv4Components(const CHAR* spec,
                           const url_parse::Component& host,
                           url_parse::Component components[4]) {
+  if (!host.is_nonempty())
+    return false;
+
   int cur_component = 0;  // Index of the component we're working on.
   int cur_component_begin = host.begin;  // Start of the current component.
   int end = host.end();
   for (int i = host.begin; /* nothing */; i++) {
-    if (i == end || spec[i] == '.') {
+    if (i >= end || spec[i] == '.') {
       // Found the end of the current component.
       int component_len = i - cur_component_begin;
       components[cur_component] =
           url_parse::Component(cur_component_begin, component_len);
 
       // The next component starts after the dot.
       cur_component_begin = i + 1;
       cur_component++;
 
       // Don't allow empty components (two dots in a row), except we may
       // allow an empty component at the end (this would indicate that the
       // input ends in a dot). We also want to error if the component is
       // empty and it's the only component (cur_component == 1).
       if (component_len == 0 && (i != end || cur_component == 1))

[Peter Kasting, 2010/05/11 18:34:33]

You should change "i != end" to "i < end" here.

         return false;
 
-      if (i == end)
+      if (i >= end)
         break;  // End of the input.
 
       if (cur_component == 4) {
         // Anything else after the 4th component is an error unless it is a
         // dot that would otherwise be treated as the end of input.
         if (spec[i] == '.' && i + 1 == end)
           break;
         return false;
       }
     } else if (static_cast<UCHAR>(spec[i]) >= 0x80 ||
@@ skipping 632 matching lines @@
 }
 
 bool IPv6AddressToNumber(const char16* spec,
                          const url_parse::Component& host,
                          unsigned char address[16]) {
   return DoIPv6AddressToNumber<char16, char16>(spec, host, address);
 }
 
 
 }  // namespace url_canon