Merge pull request #658 from djc/fuzzed-2

url: fix panic on popping from Url without path (fixes #656)

Author: valenting

url/src/path_segments.rs

@@ -123,6 +123,9 @@ impl<'a> PathSegmentsMut<'a> {
     /// # run().unwrap();
     /// ```
     pub fn pop_if_empty(&mut self) -> &mut Self {
+        if self.after_first_slash >= self.url.serialization.len() {
+            return self;
+        }
         if self.url.serialization[self.after_first_slash..].ends_with('/') {
             self.url.serialization.pop();
         }
@@ -135,6 +138,9 @@ impl<'a> PathSegmentsMut<'a> {
     ///
     /// Returns `&mut Self` so that method calls can be chained.
     pub fn pop(&mut self) -> &mut Self {
+        if self.after_first_slash >= self.url.serialization.len() {
+            return self;
+        }
         let last_slash = self.url.serialization[self.after_first_slash..]
             .rfind('/')
             .unwrap_or(0);

url/tests/unit.rs

@@ -671,3 +671,11 @@ fn no_panic() {
     let mut url = Url::parse("arhttpsps:/.//eom/dae.com/\\\\t\\:").unwrap();
     url::quirks::set_hostname(&mut url, "//eom/datcom/\\\\t\\://eom/data.cs").unwrap();
 }
+
+#[test]
+fn pop_if_empty_in_bounds() {
+    let mut url = Url::parse("m://").unwrap();
+    let mut segments = url.path_segments_mut().unwrap();
+    segments.pop_if_empty();
+    segments.pop();
+}