[epiphany] uri-helpers: Pass larger buffer to ICU

[Michael Catanzaro <mcatanzaro src gnome org>]

commit 90c7799e51cbf9e12c0d63448fb5284d934a5aa5
Author: Michael Catanzaro <mcatanzaro gnome org>
Date:   Sun Dec 18 15:09:54 2016 -0600

    uri-helpers: Pass larger buffer to ICU
    
    Our buffer was one byte too small to hold the longest-possible domain
    name.
    
    Also, we need to make sure the buffer is one byte longer than we tell
    ICU. Fill it with zeroes so that we can guarantee it remains NUL-
    terminated. It's hard to believe that U_STRING_NOT_TERMINATED_WARNING
    is a thing, but it is and we don't want to hit it....
    
    https://bugzilla.gnome.org/show_bug.cgi?id=747376

 lib/ephy-uri-helpers.c |   11 +++++++++--
 1 files changed, 9 insertions(+), 2 deletions(-)
---
diff --git a/lib/ephy-uri-helpers.c b/lib/ephy-uri-helpers.c
index dd56a71..2ce36db 100644
--- a/lib/ephy-uri-helpers.c
+++ b/lib/ephy-uri-helpers.c
@@ -285,8 +285,15 @@ ephy_uri_decode (const char *uri_string)
   /* Process any punycode in the host portion of the URI. */
   uri = soup_uri_new (uri_string);
   if (uri != NULL && uri->host != NULL) {
-    idna_decoded_name = g_malloc (MAX_DOMAIN_LENGTH);
-    uidna_nameToUnicodeUTF8 (idna, uri->host, -1, idna_decoded_name, MAX_DOMAIN_LENGTH, &info, &error);
+    /* +1 so there is space for the trailing NUL with the longest-possible
+     * domain name. +2 because ICU has this rather terrible behavior of
+     * sometimes returning a result that's not NUL-terminated if the buffer
+     * capacity exactly matches the output length, indicating that with a
+     * warning code that's not caught by U_FAILURE. Our buffer is large enough
+     * for any valid domain, but this function may receive invalid domains as
+     * input. */
+    idna_decoded_name = g_malloc0 (MAX_DOMAIN_LENGTH + 2);
+    uidna_nameToUnicodeUTF8 (idna, uri->host, -1, idna_decoded_name, MAX_DOMAIN_LENGTH + 1, &info, &error);
 
     if (U_FAILURE (error)) {
       g_warning ("ICU error converting domain %s for display: %d", uri->host, error);