Fix problem with how HttpResponseHeaders::Update() copies headers -- it assumed the value range ended in a '\0'.

BUG=14220
TEST=HttpResponseHeadersTest.Update

Review URL: http://codereview.chromium.org/132042

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@18774 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 15 insertions, 2 deletions

diff --git a/net/http/http_response_headers.cc b/net/http/http_response_headers.cc
index 81d2ceb..f6ff4df 100644
--- a/net/http/http_response_headers.cc
+++ b/net/http/http_response_headers.cc
@@ -189,7 +189,8 @@ void HttpResponseHeaders::Update(const HttpResponseHeaders& new_headers) {
 
       // preserve this header line in the merged result
       // (including trailing '\0')
-      new_raw_headers.append(name_begin, new_parsed[k].value_end + 1);
+      new_raw_headers.append(name_begin, new_parsed[k].value_end);
+      new_raw_headers.push_back('\0');
     }
 
     i = k;
@@ -208,7 +209,8 @@ void HttpResponseHeaders::Update(const HttpResponseHeaders& new_headers) {
     StringToLowerASCII(&name);
     if (updated_headers.find(name) == updated_headers.end()) {
       // ok to preserve this header in the final result
-      new_raw_headers.append(parsed_[i].name_begin, parsed_[k].value_end + 1);
+      new_raw_headers.append(parsed_[i].name_begin, parsed_[k].value_end);
+      new_raw_headers.push_back('\0');
     }
 
     i = k;
diff --git a/net/http/http_response_headers_unittest.cc b/net/http/http_response_headers_unittest.cc
index da18f11..ec26eb9 100644
--- a/net/http/http_response_headers_unittest.cc
+++ b/net/http/http_response_headers_unittest.cc
@@ -831,6 +831,17 @@ TEST(HttpResponseHeadersTest, Update) {
       "Cache-CONTROL: max-age=10000\n"
       "Foo: 1\n"
     },
+    { "HTTP/1.1 200 OK\n"
+      "Content-Length: 450\n",
+
+      "HTTP/1/1 304 Not Modified\n"
+      "connection: keep-alive\n"
+      "Cache-control:      max-age=10001   \n",
+
+      "HTTP/1.1 200 OK\n"
+      "Cache-control: max-age=10001\n"
+      "Content-Length: 450\n"
+    },
   };
 
   for (size_t i = 0; i < ARRAYSIZE_UNSAFE(tests); ++i) {