386998 better check for UNC paths

r=dveditz sr=bz

modules/libpr0n/decoders/icon/nsIconURI.cpp

@@ -305,15 +305,7 @@ nsMozIconURI::SetSpec(const nsACString &aSpec)
         rv = ioService->NewURI(mDummyFilePath, nsnull, nsnull, getter_AddRefs(tmpURI));
         if (NS_SUCCEEDED(rv) && tmpURI)
         {
-          nsCAutoString filespec;
-          tmpURI->GetSpec(filespec);
-          if ( strncmp("file:////", filespec.get(), 9) &&
-               strncmp("file:///%", filespec.get(), 9) )
-          {
-            // accept only local files; disallow UNC paths (bug 376328)
-            // and attempts to escape them (bug 386998)
-            mFileIcon = tmpURI;
-          }
+          mFileIcon = tmpURI;
         }
       }
       if (!sizeString.IsEmpty())

modules/libpr0n/decoders/icon/win/nsIconChannel.cpp

@@ -209,10 +209,8 @@ nsresult nsIconChannel::ExtractIconInfoFromUrl(nsIFile ** aLocalFile, PRUint32 *
   nsCOMPtr<nsIFile> file;
   rv = fileURL->GetFile(getter_AddRefs(file));
   if (NS_FAILED(rv) || !file) return NS_OK;
-  
-  *aLocalFile = file;
-  NS_IF_ADDREF(*aLocalFile);
-  return NS_OK;
+
+  return file->Clone(aLocalFile);
 }
 
 NS_IMETHODIMP nsIconChannel::AsyncOpen(nsIStreamListener *aListener, nsISupports *ctxt)
@@ -289,7 +287,13 @@ nsresult nsIconChannel::MakeInputStream(nsIInputStream** _retval, PRBool nonBloc
  
   if (localFile)
   {
+    rv = localFile->Normalize();
+    NS_ENSURE_SUCCESS(rv, rv);
+
     localFile->GetNativePath(filePath);
+    if (filePath.Length() < 2 || filePath[1] != ':')
+      return NS_ERROR_MALFORMED_URI; // UNC
+
     if (filePath.Last() == ':')
       filePath.Append('\\');
     else {