From 4a3190695eb3f728496f7f242ab43dfe23a66518 Mon Sep 17 00:00:00 2001 From: HushBugger Date: Tue, 16 Aug 2022 22:37:50 +0200 Subject: [PATCH] Fix buffer over-read in decode() The format specifier for parsing percent-formatted characters uses a maximum number of digits, not an exact number of digits. If the hex number has only one digit this will skip a character, potentially pointing past the terminating null byte. --- http.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/http.c b/http.c index 5b9dade..36f8b1c 100644 --- a/http.c +++ b/http.c @@ -135,12 +135,14 @@ decode(const char src[PATH_MAX], char dest[PATH_MAX]) uint8_t n; const char *s; - for (s = src, i = 0; *s; s++, i++) { - if (*s == '%' && (sscanf(s + 1, "%2hhx", &n) == 1)) { + for (s = src, i = 0; *s; i++) { + if (*s == '%' && isxdigit((unsigned char)s[1]) && + isxdigit((unsigned char)s[2])) { + sscanf(s + 1, "%2hhx", &n); dest[i] = n; - s += 2; + s += 3; } else { - dest[i] = *s; + dest[i] = *s++; } } dest[i] = '\0'; -- 2.30.2