KURL not handling NULL m_string members properly.

Source/weborigin/KURL.cpp

 /*
  * Copyright (C) 2004, 2007, 2008, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
  * Copyright (C) 2008, 2009, 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 279 matching lines @@
 {
     // Note that http://www.google.com/" has a path, the path is "/". This can
     // return false only for invalid or nonstandard URLs.
     return m_parsed.path.len >= 0;
 }
 
 // We handle "parameters" separated by a semicolon, while KURL.cpp does not,
 // which can lead to different results in some cases.
 String KURL::lastPathComponent() const
 {
-    if (!m_isValid)
+    if (m_string.isNull() || !m_isValid)

[abarth-chromium, 2013/09/17 19:57:02]

I don't understand why this change is needed.  If m_string.isNull, then
necessarily !m_isValid and we'll return early without this change.

         return stringForInvalidComponent();
 
     // When the output ends in a slash, WebCore has different expectations than
     // the GoogleURL library. For "/foo/bar/" the library will return the empty
     // string, but WebCore wants "bar".
     url_parse::Component path = m_parsed.path;
     if (path.len > 0 && m_string[path.end() - 1] == '/')
         path.len--;
 
     url_parse::Component file;
-    if (!m_string.isNull() && m_string.is8Bit())
+    if (m_string.is8Bit())
         url_parse::ExtractFileName(asURLChar8Subtle(m_string), path, &file);
     else
         url_parse::ExtractFileName(m_string.characters16(), path, &file);
 
     // Bug: https://bugs.webkit.org/show_bug.cgi?id=21015 this function returns
     // a null string when the path is empty, which we duplicate here.
     if (!file.is_nonempty())
         return String();
     return componentString(file);
 }
 
 String KURL::protocol() const
 {
     return componentString(m_parsed.scheme);
 }
 
 String KURL::host() const
 {
     return componentString(m_parsed.host);
 }
 
 // Returns 0 when there is no port.
 //
 // We treat URL's with out-of-range port numbers as invalid URLs, and they will
 // be rejected by the canonicalizer. KURL.cpp will allow them in parsing, but
 // return invalidPortNumber from this port() function, so we mirror that behavior here.
 unsigned short KURL::port() const
 {
-    if (!m_isValid || m_parsed.port.len <= 0)
+    if (m_string.isNull() || !m_isValid || m_parsed.port.len <= 0)
         return 0;
-    int port = 0;
-    if (!m_string.isNull() && m_string.is8Bit())
-        port = url_parse::ParsePort(asURLChar8Subtle(m_string), m_parsed.port);
-    else
-        port = url_parse::ParsePort(m_string.characters16(), m_parsed.port);
+    int port = m_string.is8Bit() ?
+        url_parse::ParsePort(asURLChar8Subtle(m_string), m_parsed.port) :
+        url_parse::ParsePort(m_string.characters16(), m_parsed.port);
     ASSERT(port != url_parse::PORT_UNSPECIFIED); // Checked port.len <= 0 before.
 
     if (port == url_parse::PORT_INVALID || port > maximumValidPortNumber) // Mimic KURL::port()
         port = invalidPortNumber;
 
     return static_cast<unsigned short>(port);
 }
 
 String KURL::pass() const
 {
@@ skipping 260 matching lines @@
 
     url_util::EncodeURIComponent(utf8.data(), inputLength, &buffer);
     String escaped(buffer.data(), buffer.length());
     // Unescape '/'; it's safe and much prettier.
     escaped.replace("%2F", "/");
     return escaped;
 }
 
 bool KURL::isHierarchical() const
 {
-    if (!m_parsed.scheme.is_nonempty())
+    if (m_string.isNull() || !m_parsed.scheme.is_nonempty())
         return false;
-    if (!m_string.isNull() && m_string.is8Bit())
-        return url_util::IsStandard(asURLChar8Subtle(m_string), m_parsed.scheme);
-    return url_util::IsStandard(m_string.characters16(), m_parsed.scheme);
+
+    return m_string.is8Bit() ?
+        url_util::IsStandard(asURLChar8Subtle(m_string), m_parsed.scheme) :
+        url_util::IsStandard(m_string.characters16(), m_parsed.scheme);
 }
 
 #ifndef NDEBUG
 void KURL::print() const
 {
     printf("%s\n", m_string.utf8().data());
 }
 #endif
 
 bool equalIgnoringFragmentIdentifier(const KURL& a, const KURL& b)
@@ skipping 37 matching lines @@
     return m_parsed.CountCharactersBefore(url_parse::Parsed::PATH, false);
 }
 
 unsigned KURL::pathEnd() const
 {
     return m_parsed.CountCharactersBefore(url_parse::Parsed::QUERY, true);
 }
 
 unsigned KURL::pathAfterLastSlash() const
 {
+    if (m_string.isNull())
+        return 0;
     if (!m_isValid || !m_parsed.path.is_valid())
         return m_parsed.CountCharactersBefore(url_parse::Parsed::PATH, false);
-
     url_parse::Component filename;
-    if (!m_string.isNull() && m_string.is8Bit())
+    if (m_string.is8Bit())
         url_parse::ExtractFileName(asURLChar8Subtle(m_string), m_parsed.path, &filename);
     else
         url_parse::ExtractFileName(m_string.characters16(), m_parsed.path, &filename);
     return filename.begin;
 }
 
 bool protocolIs(const String& url, const char* protocol)
 {
     assertProtocolIsGood(protocol);
     if (url.isNull())
@@ skipping 77 matching lines @@
     return false;
 }
 
 void KURL::initProtocolIsInHTTPFamily()
 {
     if (!m_isValid) {
         m_protocolIsInHTTPFamily = false;
         return;
     }
 
-    if (!m_string.isNull() && m_string.is8Bit())
-        m_protocolIsInHTTPFamily = checkIfProtocolIsInHTTPFamily(m_parsed.scheme, m_string.characters8());
-    else
-        m_protocolIsInHTTPFamily = checkIfProtocolIsInHTTPFamily(m_parsed.scheme, m_string.characters16());
+    ASSERT(!m_string.isNull());
+    m_protocolIsInHTTPFamily = m_string.is8Bit() ?
+        checkIfProtocolIsInHTTPFamily(m_parsed.scheme, m_string.characters8()) :
+        checkIfProtocolIsInHTTPFamily(m_parsed.scheme, m_string.characters16());
 }
 
 bool KURL::protocolIs(const char* protocol) const
 {
     assertProtocolIsGood(protocol);
 
     // JavaScript URLs are "valid" and should be executed even if KURL decides they are invalid.
     // The free function protocolIsJavaScript() should be used instead.
     // FIXME: Chromium code needs to be fixed for this assert to be enabled. ASSERT(strcmp(protocol, "javascript"));
 
-    if (m_parsed.scheme.len <= 0)
-        return !protocol;
-    if (!m_string.isNull() && m_string.is8Bit())
-        return internalProtocolIs(m_parsed.scheme, m_string.characters8(), protocol);
-    return internalProtocolIs(m_parsed.scheme, m_string.characters16(), protocol);
+    if (m_string.isNull() || m_parsed.scheme.len <= 0)
+        return *protocol == '\0';
+
+    return m_string.is8Bit() ?
+        internalProtocolIs(m_parsed.scheme, m_string.characters8(), protocol) :
+        internalProtocolIs(m_parsed.scheme, m_string.characters16(), protocol);
 }
 
 String KURL::stringForInvalidComponent() const
 {
     if (m_string.isNull())
         return String();
     return emptyString();
 }
 
 String KURL::componentString(const url_parse::Component& component) const
@@ skipping 24 matching lines @@
     m_string = AtomicString::fromUTF8(output.data(), output.length());
 }
 
 bool KURL::isSafeToSendToAnotherThread() const
 {
     return m_string.isSafeToSendToAnotherThread()
         && (!m_innerURL || m_innerURL->isSafeToSendToAnotherThread());
 }
 
 } // namespace WebCore