Avoid adding invalid headers in AddHeaderFromString

net/http/http_content_disposition.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/http/http_content_disposition.h"
 
 #include "base/base64.h"
 #include "base/logging.h"
+#include "base/strings/string_piece.h"
 #include "base/strings/string_tokenizer.h"
 #include "base/strings/string_util.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "net/base/escape.h"
 #include "net/base/net_string_util.h"
 #include "net/http/http_util.h"
 
 namespace net {
 
@@ skipping 322 matching lines @@
 HttpContentDisposition::~HttpContentDisposition() {
 }
 
 std::string::const_iterator HttpContentDisposition::ConsumeDispositionType(
     std::string::const_iterator begin, std::string::const_iterator end) {
   DCHECK(type_ == INLINE);
   std::string::const_iterator delimiter = std::find(begin, end, ';');
 
   std::string::const_iterator type_begin = begin;
   std::string::const_iterator type_end = delimiter;
   HttpUtil::TrimLWS(&type_begin, &type_end);

[mmenke, 2016/08/10 20:15:19]

There's a base::StringPiece version of this, too.  Can go back beyond that
without running into HttpContentDisposition::Parse, unfortuantely, which has
multiple callsites, and goes a bit beyond the scope of this CL.

[Adam Rice, 2016/08/12 05:48:33]

Done.

HttpUtil::HeadersIterator can be cleaned up similarly, but it would be cleanest
to change HttpResponseHeaders at the same time, and this CL has seen enough
scope creep.

 
   // If the disposition-type isn't a valid token the then the
   // Content-Disposition header is malformed, and we treat the first bytes as
   // a parameter rather than a disposition-type.
-  if (!HttpUtil::IsToken(type_begin, type_end))
+  if (type_begin == type_end ||
+      !HttpUtil::IsToken(
+          base::StringPiece(&*type_begin, type_end - type_begin))) {
     return begin;
+  }
 
   parse_result_flags_ |= HAS_DISPOSITION_TYPE;
 
   DCHECK(std::find(type_begin, type_end, '=') == type_end);
 
   if (base::LowerCaseEqualsASCII(base::StringPiece(type_begin, type_end),
                                  "inline")) {
     type_ = INLINE;
   } else if (base::LowerCaseEqualsASCII(base::StringPiece(type_begin, type_end),
                                         "attachment")) {
@@ skipping 55 matching lines @@
     }
   }
 
   if (!ext_filename.empty())
     filename_ = ext_filename;
   else
     filename_ = filename;
 }
 
 }  // namespace net