From a1d530479f260da079ba8217155d455f32a57b3e Mon Sep 17 00:00:00 2001
From: Gijs Kruitbosch <gijskruitbosch@gmail.com>
Date: Tue, 30 Jan 2018 12:07:08 +0000
Subject: [PATCH] Bug 1432870, r=bz

---
 chrome/nsChromeRegistry.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/chrome/nsChromeRegistry.cpp b/chrome/nsChromeRegistry.cpp
index 4443b11f93ba..8e81c531c4cf 100644
--- a/chrome/nsChromeRegistry.cpp
+++ b/chrome/nsChromeRegistry.cpp
@@ -235,6 +235,12 @@ nsChromeRegistry::Canonify(nsIURL* aChromeURL)
     // path is already unescaped once, but uris can get unescaped twice
     const char* pos = path.BeginReading();
     const char* end = path.EndReading();
+    // Must start with [a-zA-Z0-9].
+    if (!('a' <= *pos && *pos <= 'z') &&
+        !('A' <= *pos && *pos <= 'Z') &&
+        !('0' <= *pos && *pos <= '9')) {
+      return NS_ERROR_DOM_BAD_URI;
+    }
     while (pos < end) {
       switch (*pos) {
         case ':':