Malformed url can cause a bad hostText TextRange struct about uriparser

[hartwork]

I've done a bit of research on case //:%aa@ by now (but there is more to do).
What I found so far is that:

• URI //:%aa@ is well-formed despite looking weird (see grammar trace below)
• The hostname of a URI can be empty (see grammar trace below)
• hostText.first points to right after @, that looks okay
• hostText.afterLast points to : way earlier (and is set by ParseOwnHostUserInfoNz where I would not expect it)

For the (expected) grammar trace:

Case: //:%aa@

URI-reference = URI / relative-ref
 relative-ref  = relative-part [ "?" query ] [ "#" fragment ]
  relative-part = "//" authority path-abempty
=> eats "//"
   authority     = [ userinfo "@" ] host [ ":" port ]
=> eats ":%aa" and then "@", hostname can be empty (see reg-name below)
    userinfo      = *( unreserved / pct-encoded / sub-delims / ":" )
    host          = IP-literal / IPv4address / reg-name
     reg-name      = *( unreserved / pct-encoded / sub-delims )

[hartwork]

Will have a closer look as soon as time permits. Thumbs up for the report!

[schwehr]

Thanks! I have been running a fuzzer for a week with 28 cores and have yet to find anything else. However, my fuzzing code doesn't have all the API calls and only covers ASCII/char. I build with wchar_t disabled.