Bug 3423: access violation in URL parser

diff --git a/src/url.cc b/src/url.cc
index ee1ec393aba4630706a99b0196f001e945ee15e3..54b7992886e78c977b032d424b38650a2886d867 100644 (file)
--- a/src/url.cc
+++ b/src/url.cc
@@ -250,8 +250,7 @@ urlParse(const HttpRequestMethod& method, char *url, HttpRequest *request)
         *dst = '\0';
 
         /* Then its :// */
-        /* (XXX yah, I'm not checking we've got enough data left before checking the array..) */
-        if (*src != ':' || *(src + 1) != '/' || *(src + 2) != '/')
+        if ((i+3) > l || *src != ':' || *(src + 1) != '/' || *(src + 2) != '/')
             return NULL;
         i += 3;
         src += 3;