Fix OOB read when parsing protocol-relative URLs

url/url_canon_relative.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Canonicalizer functions for working with and resolving relative URLs.
 
 #include "base/logging.h"
 #include "url/url_canon.h"
 #include "url/url_canon_internal.h"
 #include "url/url_file.h"
@@ skipping 354 matching lines @@
 bool DoResolveRelativeHost(const char* base_url,
                            const url_parse::Parsed& base_parsed,
                            const CHAR* relative_url,
                            const url_parse::Component& relative_component,
                            CharsetConverter* query_converter,
                            CanonOutput* output,
                            url_parse::Parsed* out_parsed) {
   // Parse the relative URL, just like we would for anything following a
   // scheme.
   url_parse::Parsed relative_parsed;  // Everything but the scheme is valid.
-  url_parse::ParseAfterScheme(&relative_url[relative_component.begin],
-                              relative_component.len, relative_component.begin,
-                              &relative_parsed);
+  url_parse::ParseAfterScheme(relative_url, relative_component.end(),
+                              relative_component.begin, &relative_parsed);
 
   // Now we can just use the replacement function to replace all the necessary
   // parts of the old URL with the new one.
   Replacements<CHAR> replacements;
   replacements.SetUsername(relative_url, relative_parsed.username);
   replacements.SetPassword(relative_url, relative_parsed.password);
   replacements.SetHost(relative_url, relative_parsed.host);
   replacements.SetPort(relative_url, relative_parsed.port);
   replacements.SetPath(relative_url, relative_parsed.path);
   replacements.SetQuery(relative_url, relative_parsed.query);
@@ skipping 157 matching lines @@
                         const url_parse::Component& relative_component,
                         CharsetConverter* query_converter,
                         CanonOutput* output,
                         url_parse::Parsed* out_parsed) {
   return DoResolveRelativeURL<base::char16>(
       base_url, base_parsed, base_is_file, relative_url,
       relative_component, query_converter, output, out_parsed);
 }
 
 }  // namespace url_canon