Fix problem with how HttpResponseHeaders::Update() copies headers -- it assumed the value range ended in a '\0'.

BUG=14220
TEST=HttpResponseHeadersTest.Update

Review URL: http://codereview.chromium.org/132042

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@18774 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 4 insertions, 2 deletions

diff --git a/net/http/http_response_headers.cc b/net/http/http_response_headers.cc
index 81d2ceb..f6ff4df 100644
--- a/net/http/http_response_headers.cc
+++ b/net/http/http_response_headers.cc
@@ -189,7 +189,8 @@ void HttpResponseHeaders::Update(const HttpResponseHeaders& new_headers) {
 
       // preserve this header line in the merged result
       // (including trailing '\0')
-      new_raw_headers.append(name_begin, new_parsed[k].value_end + 1);
+      new_raw_headers.append(name_begin, new_parsed[k].value_end);
+      new_raw_headers.push_back('\0');
     }
 
     i = k;
@@ -208,7 +209,8 @@ void HttpResponseHeaders::Update(const HttpResponseHeaders& new_headers) {
     StringToLowerASCII(&name);
     if (updated_headers.find(name) == updated_headers.end()) {
       // ok to preserve this header in the final result
-      new_raw_headers.append(parsed_[i].name_begin, parsed_[k].value_end + 1);
+      new_raw_headers.append(parsed_[i].name_begin, parsed_[k].value_end);
+      new_raw_headers.push_back('\0');
     }
 
     i = k;