Bug 3423: access violation in URL parser

diff --git a/src/url.cc b/src/url.cc
index 79fab548cb37c3802de0b4853eaade1b9ffb6784..e6a855ac303ffac1465b0844c4183edfeb5b36a0 100644 (file)
--- a/src/url.cc
+++ b/src/url.cc
@@ -249,8 +249,7 @@ urlParse(const HttpRequestMethod& method, char *url, HttpRequest *request)
         *dst = '\0';
 
         /* Then its :// */
-        /* (XXX yah, I'm not checking we've got enough data left before checking the array..) */
-        if (*src != ':' || *(src + 1) != '/' || *(src + 2) != '/')
+        if ((i+3) > l || *src != ':' || *(src + 1) != '/' || *(src + 2) != '/')
             return NULL;
         i += 3;
         src += 3;