diff --git a/toolkit/components/url-classifier/content/enchash-decrypter.js b/toolkit/components/url-classifier/content/enchash-decrypter.js
index 855c88efb3ff..3d5f50e4a4bb 100644
--- a/toolkit/components/url-classifier/content/enchash-decrypter.js
+++ b/toolkit/components/url-classifier/content/enchash-decrypter.js
@@ -111,6 +111,8 @@ PROT_EnchashDecrypter.REs.FIND_END_DOTS_GLOBAL =
   new RegExp("^\\.+|\\.+$", "g");
 PROT_EnchashDecrypter.REs.FIND_MULTIPLE_DOTS_GLOBAL =
   new RegExp("\\.{2,}", "g");
+PROT_EnchashDecrypter.REs.FIND_TRAILING_SPACE =
+  new RegExp("^(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}) ");
 PROT_EnchashDecrypter.REs.POSSIBLE_IP =
   new RegExp("^((?:0x[0-9a-f]+|[0-9\\.])+)$", "i");
 PROT_EnchashDecrypter.REs.FIND_BAD_OCTAL = new RegExp("(^|\\.)0\\d*[89]");
@@ -275,6 +277,21 @@ PROT_EnchashDecrypter.prototype.getCanonicalHost = function(str, opt_maxDots) {
 }
 
 PROT_EnchashDecrypter.prototype.parseIPAddress_ = function(host) {
+  if (host.length <= 15) {
+
+    // The Windows resolver allows a 4-part dotted decimal IP address to
+    // have a space followed by any old rubbish, so long as the total length
+    // of the string doesn't get above 15 characters. So, "10.192.95.89 xy"
+    // is resolved to 10.192.95.89.
+    // If the string length is greater than 15 characters, e.g.
+    // "10.192.95.89 xy.wildcard.example.com", it will be resolved through
+    // DNS.
+    var match = this.REs_.FIND_TRAILING_SPACE.exec(host);
+    if (match) {
+      host = match[1];
+    }
+  }
+  
   if (!this.REs_.POSSIBLE_IP.test(host))
     return "";
 
@@ -293,13 +310,14 @@ PROT_EnchashDecrypter.prototype.parseIPAddress_ = function(host) {
     }
     if (canon != "") 
       parts[k] = canon;
+    else
+      return "";
   }
 
   return parts.join(".");
 }
 
 PROT_EnchashDecrypter.prototype.canonicalNum_ = function(num, bytes, octal) {
-  
   if (bytes < 0) 
     return "";
   var temp_num;
@@ -321,8 +339,10 @@ PROT_EnchashDecrypter.prototype.canonicalNum_ = function(num, bytes, octal) {
       temp_num = -1;
 
   } else if (this.REs_.IS_HEX.test(num)) {
-
-    num = this.lastNChars_(num, 8);
+    var matches = this.REs_.IS_HEX.exec(num);
+    if (matches) {
+      num = matches[1];
+    }
 
     temp_num = parseInt(num, 16);
     if (isNaN(temp_num))
diff --git a/toolkit/components/url-classifier/tests/test_bug356355.xhtml b/toolkit/components/url-classifier/tests/test_bug356355.xhtml
index 86889f125ca6..5aa7eedca170 100644
--- a/toolkit/components/url-classifier/tests/test_bug356355.xhtml
+++ b/toolkit/components/url-classifier/tests/test_bug356355.xhtml
@@ -243,7 +243,11 @@ var tests =
    "123", "0173", 1, true,
    "9", "09", 1, false,
    "", "0x120x34", 2, true,
-   "18.252", "0x12fc", 2, true];
+   "18.252", "0x12fc", 2, true,
+   "89", "0x0000059", 1, true,
+   "89", "0x00000059", 1, true,
+   "103", "0x0000067", 1, true
+   ];
 for (var i = 0; i < tests.length; i+= 4) {
   ok(tests[i] === l.canonicalNum_(tests[i + 1], tests[i + 2], tests[i + 3]),
      "canonicalNum broken on: " + tests[i + 1]);
@@ -261,6 +265,11 @@ testing["413960661"] = "24.172.137.213";
 testing["03053104725"] = "24.172.137.213";
 testing["030.0254.0x89d5"] = "24.172.137.213";
 testing["1.234.4.0377"] = "1.234.4.255";
+testing["1.2.3.00x0"] = "";
+testing["10.192.95.89 xy"] = "10.192.95.89";
+testing["10.192.95.89 xyz"] = "";
+testing["1.2.3.0x0"] = "1.2.3.0";
+testing["1.2.3.4"] = "1.2.3.4";
 
 for (var key in testing) {
   ok(l.parseIPAddress_(key) === testing[key],