From 12d3873aa78689ef48d2260987f56d354a80391f Mon Sep 17 00:00:00 2001
From: Aleric Inglewood <Aleric.Inglewood@gmail.com>
Date: Sun, 22 Sep 2013 23:25:40 +0200
Subject: [PATCH] Crash fix for empty media URL.

Apparently LLViewerMediaImpl::navigateInternal could be called with
an empty url. That lead to a curl request with an empty url, which
failed because that leads to an empty 'service' string, which is
not allowed.

Patched the code to ignore empty media urls and hardened AICurl
to deal with any remaining cases.
---
 indra/llmessage/aicurleasyrequeststatemachine.cpp |  9 +++++++++
 indra/llmessage/aicurlperservice.cpp              |  2 +-
 indra/newview/llviewermedia.cpp                   | 12 ++++++++++++
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/indra/llmessage/aicurleasyrequeststatemachine.cpp b/indra/llmessage/aicurleasyrequeststatemachine.cpp
index ed2bf820d..0437055f5 100644
--- a/indra/llmessage/aicurleasyrequeststatemachine.cpp
+++ b/indra/llmessage/aicurleasyrequeststatemachine.cpp
@@ -116,6 +116,15 @@ void AICurlEasyRequestStateMachine::multiplex_impl(state_type run_state)
 	{
 	  set_state(AICurlEasyRequestStateMachine_waitAdded);
 	  idle();							// Wait till AICurlEasyRequestStateMachine::added_to_multi_handle() is called.
+
+	  // This is a work around for the case that this request had a bad url, in order to avoid a crash later on.
+	  bool empty_url = AICurlEasyRequest_rat(*mCurlEasyRequest)->getLowercaseServicename().empty();
+	  if (empty_url)
+	  {
+		abort();
+		break;
+	  }
+
 	  // Only AFTER going idle, add request to curl thread; this is needed because calls to set_state() are
 	  // ignored when the statemachine is not idle, and theoretically the callbacks could be called
 	  // immediately after this call.
diff --git a/indra/llmessage/aicurlperservice.cpp b/indra/llmessage/aicurlperservice.cpp
index 8a58e2c98..af01e94f0 100644
--- a/indra/llmessage/aicurlperservice.cpp
+++ b/indra/llmessage/aicurlperservice.cpp
@@ -214,7 +214,7 @@ std::string AIPerService::extract_canonical_servicename(std::string const& url)
     }
     ++p;
   }
-  // Strip of any trailing ":80".
+  // Strip off any trailing ":80".
   if (p - 3 == port_colon && p[-1] == '0' && p[-2] == '8')
   {
     return servicename.substr(0, p - hostname - 3);
diff --git a/indra/newview/llviewermedia.cpp b/indra/newview/llviewermedia.cpp
index 6b3aa2a21..cdf86c074 100644
--- a/indra/newview/llviewermedia.cpp
+++ b/indra/newview/llviewermedia.cpp
@@ -2595,6 +2595,12 @@ void LLViewerMediaImpl::unload()
 //////////////////////////////////////////////////////////////////////////////////////////
 void LLViewerMediaImpl::navigateTo(const std::string& url, const std::string& mime_type,  bool rediscover_type, bool server_request)
 {
+	if (url.empty())
+	{
+		llwarns << "Calling LLViewerMediaImpl::navigateTo with empty url" << llendl;
+		return;
+	}
+
 	cancelMimeTypeProbe();
 
 	if(mMediaURL != url)
@@ -2639,6 +2645,12 @@ void LLViewerMediaImpl::navigateInternal()
 	// Helpful to have media urls in log file. Shouldn't be spammy.
 	llinfos << "media id= " << mTextureId << " url=" << mMediaURL << " mime_type=" << mMimeType << llendl;
 
+	if (mMediaURL.empty())
+	{
+		llwarns << "Calling LLViewerMediaImpl::navigateInternal() with empty mMediaURL" << llendl;
+		return;
+	}
+
 	if(mNavigateSuspended)
 	{
 		llwarns << "Deferring navigate." << llendl;