Fix an out of band read when parsing a URL component of just "%". The...

net/base/escape.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 
 #include "net/base/escape.h"
 
 #include "base/logging.h"
 #include "base/string_util.h"
@@ skipping 95 matching lines @@
 };
 
 std::string UnescapeURLImpl(const std::string& escaped_text,
                             UnescapeRule::Type rules) {
   // The output of the unescaping is always smaller than the input, so we can
   // reserve the input size to make sure we have enough buffer and don't have
   // to allocate in the loop below.
   std::string result;
   result.reserve(escaped_text.length());
 
-  for (size_t i = 0, max = escaped_text.size(), max_digit_index = max - 2;
-       i < max; ++i) {
-    if (escaped_text[i] == '%' && i < max_digit_index) {
+  for (size_t i = 0, max = escaped_text.size(); i < max; ++i) {
+    if (escaped_text[i] == '%' && i + 2 < max) {
       const std::string::value_type most_sig_digit(escaped_text[i + 1]);
       const std::string::value_type least_sig_digit(escaped_text[i + 2]);
       if (IsHex(most_sig_digit) && IsHex(least_sig_digit)) {
         unsigned char value = HexToInt(most_sig_digit) * 16 +
             HexToInt(least_sig_digit);
         if (value >= 0x80 ||  // Unescape all high-bit characters.
             // For 7-bit characters, the lookup table tells us all valid chars.
             (kUrlUnescape[value] ||
              // ...and we allow some additional unescaping when flags are set.
              (value == ' ' && (rules & UnescapeRule::SPACES)) ||
@@ skipping 148 matching lines @@
 }
 
 std::string EscapeForHTML(const std::string& input) {
   return EscapeForHTMLImpl(input);
 }
 
 std::wstring EscapeForHTML(const std::wstring& input) {
   return EscapeForHTMLImpl(input);
 }