NormalizeIDN can (and should, I think) normalize to an empty string in some cases, so don't use AppendSegmentToBuf, which will do the wrong thing with an empty string and potentially overrun buffer. b=307259 r=darin sr=dveditz

netwerk/base/src/nsStandardURL.cpp

@@ -467,6 +467,7 @@ nsStandardURL::BuildNormalizedSpec(const char *spec)
     nsCAutoString encUsername;
     nsCAutoString encPassword;
     nsCAutoString encHost;
+    PRBool useEncHost;
     nsCAutoString encDirectory;
     nsCAutoString encBasename;
     nsCAutoString encExtension;
@@ -506,7 +507,7 @@ nsStandardURL::BuildNormalizedSpec(const char *spec)
     if (mHost.mLen > 0) {
         const nsCSubstring& tempHost =
             Substring(spec + mHost.mPos, spec + mHost.mPos + mHost.mLen);
-        if (NormalizeIDN(tempHost, encHost))
+        if ((useEncHost = NormalizeIDN(tempHost, encHost)))
             approxLen += encHost.Length();
         else
             approxLen += mHost.mLen;
@@ -539,7 +540,13 @@ nsStandardURL::BuildNormalizedSpec(const char *spec)
         buf[i++] = '@';
     }
     if (mHost.mLen > 0) {
-        i = AppendSegmentToBuf(buf, i, spec, mHost, &encHost);
+        if (useEncHost) {
+            mHost.mPos = i;
+            mHost.mLen = encHost.Length();
+            i = AppendToBuf(buf, i, encHost.get(), mHost.mLen);
+        }
+        else
+            i = AppendSegmentToBuf(buf, i, spec, mHost);
         net_ToLowerCase(buf + mHost.mPos, mHost.mLen);
         if (mPort != -1 && mPort != mDefaultPort) {
             nsCAutoString portbuf;