Fix heap overflow on uri parsing (#1185)

Author: TingDaoK

source/uri.c

@@ -282,8 +282,9 @@ static void s_parse_scheme(struct uri_parser *parser, struct aws_byte_cursor *st
         return;
     }
 
-    /* make sure we didn't just pick up the port by mistake */
-    if ((size_t)(location_of_colon - str->ptr) < str->len && *(location_of_colon + 1) != '/') {
+    /* Ensure location_of_colon is not the last character before checking *(location_of_colon + 1) */
+    if ((size_t)(location_of_colon - str->ptr) + 1 >= str->len || *(location_of_colon + 1) != '/') {
+        /* make sure we didn't just pick up the port by mistake */
         parser->state = ON_AUTHORITY;
         return;
     }

tests/CMakeLists.txt

@@ -513,6 +513,7 @@ add_test_case(uri_ipv4_parse)
 add_test_case(uri_invalid_scheme_parse)
 add_test_case(uri_invalid_port_parse)
 add_test_case(uri_port_too_large_parse)
+add_test_case(uri_single_colon_parse)
 add_test_case(uri_builder)
 add_test_case(uri_builder_from_string)
 add_test_case(test_uri_encode_path_rfc3986)

tests/uri_test.c

@@ -593,6 +593,18 @@ static int s_test_uri_port_too_large_parse(struct aws_allocator *allocator, void
 
 AWS_TEST_CASE(uri_port_too_large_parse, s_test_uri_port_too_large_parse);
 
+static int s_test_uri_single_colon_parse(struct aws_allocator *allocator, void *ctx) {
+    (void)ctx;
+    const char *str_uri = ":";
+    struct aws_byte_cursor uri_csr = aws_byte_cursor_from_array(str_uri, 1);
+    struct aws_uri uri;
+    ASSERT_SUCCESS(aws_uri_init_parse(&uri, allocator, &uri_csr));
+    aws_uri_clean_up(&uri);
+    return AWS_OP_SUCCESS;
+}
+
+AWS_TEST_CASE(uri_single_colon_parse, s_test_uri_single_colon_parse);
+
 static int s_test_uri_builder(struct aws_allocator *allocator, void *ctx) {
     (void)ctx;
     const char *str_uri =