From eec762686b49d4850c3bdfa32c75faffe834c688 Mon Sep 17 00:00:00 2001 From: Adrien Destugues Date: Wed, 30 Jul 2014 15:51:13 +0200 Subject: [PATCH] Safer URL decoding. Some URLs may use the % character for other purposes than URL-encoding (this is seen in some data URLs). Make sure we parse that properly, and avoid a possible out of bounds access if the percent char is near the end of the string. --- src/kits/network/libnetapi/Url.cpp | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/src/kits/network/libnetapi/Url.cpp b/src/kits/network/libnetapi/Url.cpp index 0acc611656..868d6fc029 100644 --- a/src/kits/network/libnetapi/Url.cpp +++ b/src/kits/network/libnetapi/Url.cpp @@ -1004,14 +1004,26 @@ BUrl::_DoUrlDecodeChunk(const BString& chunk, bool strict) for (int32 i = 0; i < chunk.Length(); i++) { if (chunk[i] == '+' && !strict) result << ' '; - else if (chunk[i] != '%') - result << chunk[i]; else { - char hexString[] = { chunk[i + 1], chunk[i + 2], 0 }; - result << (char)strtol(hexString, NULL, 16); + bool isEncoded = false; + char decoded = 0; - i += 2; - } + if (chunk[i] == '%' && i < chunk.Length() - 2) + { + char hexString[] = { chunk[i + 1], chunk[i + 2], 0 }; + char* out = NULL; + decoded = (char)strtol(hexString, &out, 16); + if (out == hexString + 2) { + isEncoded = true; + i += 2; + } + } + + if (isEncoded) + result << decoded; + else + result << chunk[i]; + } } return result; }