mailinfo: don't decode invalid =XY quoted-printable sequences
Decode =XY in quoted-printable segments only if X and Y are hexadecimal digits, otherwise just copy them. That's at least better than interpreting negative results from hexval() as a character. Reported-by: Jeff King <peff@peff.net> Signed-off-by: Rene Scharfe <l.s.r@web.de> Signed-off-by: Junio C Hamano <gitster@pobox.com>
René Scharfe committed
Sep 23, 2017 at 20:04 UTC
c8cf423eab6f260128859dfec991c36c54a3551c
1 file changed
+8
-3
mailinfo.c
+8
-3
@@ -367,11 +367,16 @@ static struct strbuf *decode_q_segment(const struct strbuf *q_seg, int rfc2047)
367
368
while ((c = *in++) != 0) {
369
if (c == '=') {
370
- int d = *in++;
370
+ int ch, d = *in;
371
if (d == '\n' || !d)
372
break; /* drop trailing newline */
373
- strbuf_addch(out, (hexval(d) << 4) | hexval(*in++));
374
- continue;
373
+ ch = hex2chr(in);
374
+ if (ch >= 0) {
375
+ strbuf_addch(out, ch);
376
+ in += 2;
377
+ continue;
378
+ }
379
+ /* garbage -- fall through */
380
}
381
if (rfc2047 && c == '_') /* rfc2047 4.2 (2) */
382
c = 0x20;