Avoid rune overflow when converting to unicode

idn/punycode.go

@@ -254,6 +254,10 @@ func decode(b []byte) []byte {
 				return src
 			}
 			i += digit * w
+			if i < 0 {
+				// safety check for rune overflow
+				return src
+			}
 
 			t = tfunc(k, bias)
 			if digit < t {

idn/punycode_test.go

@@ -86,7 +86,7 @@ var invalidACEs = []string{
 	"xn--*",
 	"xn--",
 	"xn---",
-	//"xn--a000000000", // crashes IDN. TODO(miek): Fix.
+	"xn--a000000000",
 }
 
 func TestInvalidPunycode(t *testing.T) {