Index: net/http/http_response_headers.cc |
diff --git a/net/http/http_response_headers.cc b/net/http/http_response_headers.cc |
index 0072976ada2e16891a487683d7c2ed1dd214be71..1c83d7f17b97b8c57ea96da76f492962e618b3ad 100644 |
--- a/net/http/http_response_headers.cc |
+++ b/net/http/http_response_headers.cc |
@@ -1431,7 +1431,8 @@ bool HttpResponseHeaders::IsChromeProxyResponse() const { |
// space following it are always |kVersionSize| characters. E.g., |
// 'Via: 1.1 Chrome-Compression-Proxy' |
while (EnumerateHeader(&iter, "via", &value)) { |
- if (!value.compare(kVersionSize, value_len, kChromeProxyViaValue)) |
+ if (value.size() >= kVersionSize + value_len && |
+ !value.compare(kVersionSize, value_len, kChromeProxyViaValue)) |
return true; |
} |