DNSDomainFromDot: Reject empty labels.

net/base/dns_util.cc

Index: net/base/dns_util.cc
diff --git a/net/base/dns_util.cc b/net/base/dns_util.cc
index f75cd956663e77123cb90a8614cdba27b667f6f7..9afaf4faec903234bc27c11202169c04d25407a9 100644
--- a/net/base/dns_util.cc
+++ b/net/base/dns_util.cc
@@ -24,14 +24,15 @@ bool DNSDomainFromDot(const base::StringPiece& dotted, std::string* out) {
     ch = *buf++;
     --n;
     if (ch == '.') {
-      if (labellen) {
-        if (namelen + labellen + 1 > sizeof name)
-          return false;
-        name[namelen++] = static_cast<char>(labellen);
-        memcpy(name + namelen, label, labellen);
-        namelen += labellen;
-        labellen = 0;
-      }
+      // Don't allow empty labels per http://crbug.com/456391.
+      if (!labellen)
+        return false;
+      if (namelen + labellen + 1 > sizeof name)
+        return false;
+      name[namelen++] = static_cast<char>(labellen);
+      memcpy(name + namelen, label, labellen);
+      namelen += labellen;
+      labellen = 0;
       continue;
     }
     if (labellen >= sizeof label)
@@ -39,6 +40,7 @@ bool DNSDomainFromDot(const base::StringPiece& dotted, std::string* out) {
     label[labellen++] = ch;
   }
 
+  // Allow empty label at end of name to disable suffix search.
   if (labellen) {
     if (namelen + labellen + 1 > sizeof name)
       return false;