net/http: crash in *Client.Do() on malformed URLs

[tmm1]

What version of Go are you using (go version)?

$ go version
go version go1.12 darwin/amd64

Does this issue reproduce with the latest release?

Yes.

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/tmm1/Library/Caches/go-build"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOOS="darwin"
GOPATH="/Users/tmm1/go"
GOPROXY=""
GORACE=""
GOROOT="/usr/local/Cellar/go/1.12/libexec"
GOTMPDIR=""
GOTOOLDIR="/usr/local/Cellar/go/1.12/libexec/pkg/tool/darwin_amd64"
GCCGO="gccgo"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/_2/hljyy_zj3912lv9qqpy70t5w0000gn/T/go-build354303837=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

package main

import (
    "log"
    "net/http"
)

func main() {
    url := "http://google.com/\x00\xc0rB,\x03?abc=123"
    r, err := http.Get(url)
    log.Printf("r=%v, err=%v", r, err)

    cli := &http.Client{}
    r, err = cli.Get(url)
    log.Printf("r=%v, err=%v", r, err)

    req, _ := http.NewRequest("GET", url, nil)
    r, err = cli.Do(req)
    log.Printf("r=%v, err=%v", r, err)
}

What did you expect to see?

No crashes.

What did you see instead?

2019/03/18 14:07:41 r=<nil>, err=parse http://google.com/�rB,?abc=123: net/url: invalid control character in URL
2019/03/18 14:07:41 r=<nil>, err=parse http://google.com/�rB,?abc=123: net/url: invalid control character in URL
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x10 pc=0x11e7bff]

goroutine 1 [running]:
net/http.(*Client).do(0xc0000a2030, 0x0, 0x0, 0x0, 0x0)
	/usr/local/Cellar/go/1.12/libexec/src/net/http/client.go:518 +0x8f
net/http.(*Client).Do(...)
	/usr/local/Cellar/go/1.12/libexec/src/net/http/client.go:509
main.main()
	/tmp/gocrahs/test.go:18 +0x1b8
exit status 2

[tmm1]

Doh, I'm ignoring the error returned by http.NewRequest and essentially passing nil into client.Do().