Bug 430910 - nsStandardURL gets confused when the query string or the anchor name contains slash characters; r=bzbarsky a=roc

netwerk/base/src/nsStandardURL.cpp

@@ -2005,13 +2005,13 @@ nsStandardURL::GetRelativeSpec(nsIURI *uri2, nsACString &aResult)
     while ((*(thatIndex-1) != '/') && (thatIndex != startCharPos))
         thatIndex--;
 
+    const char *limit = mSpec.get() + mFilepath.mPos + mFilepath.mLen;
+
     // need to account for slashes and add corresponding "../"
-    while (*thisIndex)
+    for (; thisIndex <= limit && *thisIndex; ++thisIndex)
     {
         if (*thisIndex == '/')
             aResult.AppendLiteral("../");
-
-        thisIndex++;
     }
 
     // grab spec from thisIndex to end

netwerk/test/unit/test_bug553970.js

@@ -17,6 +17,24 @@ function run_test() {
     ["http://foo.com/bar/",  "http://foo.com:80/bar/",  ""                       ],
     ["http://foo.com/",      "http://foo.com/a.htm#b",  "a.htm#b"                ],
     ["http://foo.com/a/b/",  "http://foo.com/c",        "../../c"                ],
+    ["http://foo.com/a?b/c/", "http://foo.com/c" ,      "c"                      ],
+    ["http://foo.com/a#b/c/", "http://foo.com/c" ,      "c"                      ],
+    ["http://foo.com/a;p?b/c/", "http://foo.com/c" ,    "c"                      ],
+    ["http://foo.com/a/b?c/d/", "http://foo.com/c",     "../c"                   ],
+    ["http://foo.com/a/b#c/d/", "http://foo.com/c",     "../c"                   ],
+    ["http://foo.com/a/b;p?c/d/", "http://foo.com/c",   "../c"                   ],
+    ["http://foo.com/a/b/c?d/e/", "http://foo.com/f",   "../../f"                ],
+    ["http://foo.com/a/b/c#d/e/", "http://foo.com/f",   "../../f"                ],
+    ["http://foo.com/a/b/c;p?d/e/", "http://foo.com/f", "../../f"                ],
+    ["http://foo.com/a?b/c/", "http://foo.com/c/d" ,    "c/d"                    ],
+    ["http://foo.com/a#b/c/", "http://foo.com/c/d" ,    "c/d"                    ],
+    ["http://foo.com/a;p?b/c/", "http://foo.com/c/d" ,  "c/d"                    ],
+    ["http://foo.com/a/b?c/d/", "http://foo.com/c/d",   "../c/d"                 ],
+    ["http://foo.com/a/b#c/d/", "http://foo.com/c/d",   "../c/d"                 ],
+    ["http://foo.com/a/b;p?c/d/", "http://foo.com/c/d", "../c/d"                 ],
+    ["http://foo.com/a/b/c?d/e/", "http://foo.com/f/g/", "../../f/g/"            ],
+    ["http://foo.com/a/b/c#d/e/", "http://foo.com/f/g/", "../../f/g/"            ],
+    ["http://foo.com/a/b/c;p?d/e/", "http://foo.com/f/g/", "../../f/g/"          ],
   ];
 
   for (var i = 0; i < tests.length; i++) {