Bug 1517542 - Fail URL deserialization if query or ref start at position 0. r=mayhemer, a=RyanVM
authorValentin Gosu <valentin.gosu@gmail.com>
Tue, 08 Jan 2019 15:00:05 +0000
changeset 509373 e80c71637a6385d6b99dc4b35792edfa3ad171b1
parent 509372 96ac45c9342eec26d42d514854ddea81f906a75c
child 509374 d9cb99521a77d8d98fd423b959f8a7179750f5dd
push id1905
push userffxbld-merge
push dateMon, 21 Jan 2019 12:33:13 +0000
treeherdermozilla-release@c2fca1944d8c [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersmayhemer, RyanVM
bugs1517542
milestone65.0
Bug 1517542 - Fail URL deserialization if query or ref start at position 0. r=mayhemer, a=RyanVM Differential Revision: https://phabricator.services.mozilla.com/D15854
netwerk/base/nsStandardURL.cpp
--- a/netwerk/base/nsStandardURL.cpp
+++ b/netwerk/base/nsStandardURL.cpp
@@ -3426,19 +3426,22 @@ bool nsStandardURL::Deserialize(const UR
   // Make sure scheme is followed by :// (3 characters)
   NS_ENSURE_TRUE(mScheme.mLen < INT32_MAX - 3, false);  // avoid overflow
   NS_ENSURE_TRUE(mSpec.Length() >= (uint32_t)mScheme.mLen + 3, false);
   NS_ENSURE_TRUE(
       nsDependentCSubstring(mSpec, mScheme.mLen, 3).EqualsLiteral("://"),
       false);
   NS_ENSURE_TRUE(mPath.mLen != -1 && mSpec.CharAt(mPath.mPos) == '/', false);
   NS_ENSURE_TRUE(mPath.mPos == mFilepath.mPos, false);
-  NS_ENSURE_TRUE(mQuery.mLen == -1 || mSpec.CharAt(mQuery.mPos - 1) == '?',
+  NS_ENSURE_TRUE(mQuery.mLen == -1 ||
+                     (mQuery.mPos > 0 && mSpec.CharAt(mQuery.mPos - 1) == '?'),
                  false);
-  NS_ENSURE_TRUE(mRef.mLen == -1 || mSpec.CharAt(mRef.mPos - 1) == '#', false);
+  NS_ENSURE_TRUE(
+      mRef.mLen == -1 || (mRef.mPos > 0 && mSpec.CharAt(mRef.mPos - 1) == '#'),
+      false);
 
   return true;
 }
 
 //----------------------------------------------------------------------------
 // nsStandardURL::nsIClassInfo
 //----------------------------------------------------------------------------