Don't interpret embeded NULLs in a response header line as a line terminator.

net/http/http_util.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // The rules for parsing content-types were borrowed from Firefox:
 // http://lxr.mozilla.org/mozilla/source/netwerk/base/src/nsURLHelper.cpp#834
 
 #include "net/http/http_util.h"
 
 #include <algorithm>
@@ skipping 529 matching lines @@
   while (lines.GetNext()) {
     const char* line_begin = lines.token_begin();
     const char* line_end = lines.token_end();
 
     if (prev_line_continuable && IsLWS(*line_begin)) {
       // Join continuation; reduce the leading LWS to a single SP.
       raw_headers.push_back(' ');
       raw_headers.append(FindFirstNonLWS(line_begin, line_end), line_end);
     } else {
       // Terminate the previous line.
-      raw_headers.push_back('\0');
+      raw_headers.push_back('\n');
 
       // Copy the raw data to output.
       raw_headers.append(line_begin, line_end);
 
       // Check if the current line can be continued.
       prev_line_continuable = IsLineSegmentContinuable(line_begin, line_end);
     }
   }
 
-  raw_headers.append("\0\0", 2);
+  raw_headers.append("\n\n", 2);
+
+  // Use '\0' as the canonical line terminator. If the input already contained
+  // any embeded '\0' characters we will strip them first to avoid interpreting
+  // them as line breaks.
+  raw_headers.erase(std::remove(raw_headers.begin(), raw_headers.end(), '\0'),
+                    raw_headers.end());
+  std::replace(raw_headers.begin(), raw_headers.end(), '\n', '\0');
+
   return raw_headers;
 }
 
 std::string HttpUtil::ConvertHeadersBackToHTTPResponse(const std::string& str) {
   std::string disassembled_headers;
   StringTokenizer tokenizer(str, std::string(1, '\0'));
   while (tokenizer.GetNext()) {
     disassembled_headers.append(tokenizer.token_begin(), tokenizer.token_end());
     disassembled_headers.append("\r\n");
   }
@@ skipping 215 matching lines @@
       value_is_quoted_ = true;
       // Do not store iterators into this. See declaration of unquoted_value_.
       unquoted_value_ = HttpUtil::Unquote(value_begin_, value_end_);
     }
   }
 
   return true;
 }
 
 }  // namespace net