From af252f5c3d4e62f4db39bbc65f3eea4f853d04bc Mon Sep 17 00:00:00 2001
From: Christian Grothoff <christian@grothoff.org>
Date: Wed, 12 Jan 2022 20:30:37 +0100
Subject: -conclude hello-uri implementation and test

---
 src/util/strings.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

(limited to 'src/util/strings.c')

diff --git a/src/util/strings.c b/src/util/strings.c
index a77f09022..7e218cc59 100644
--- a/src/util/strings.c
+++ b/src/util/strings.c
@@ -1813,12 +1813,19 @@ GNUNET_STRINGS_urldecode (const char *data,
   char *wpos = *out;
   size_t resl = 0;
 
-  while ('\0' != *rpos)
+  while ( ('\0' != *rpos) &&
+          (data + len != rpos) )
   {
     unsigned int num;
     switch (*rpos)
     {
     case '%':
+      if (rpos + 3 > data + len)
+      {
+        GNUNET_break_op (0);
+        GNUNET_free (*out);
+        return 0;
+      }
       if (1 != sscanf (rpos + 1, "%2x", &num))
         break;
       *wpos = (char) ((unsigned char) num);
-- 
cgit v1.2.3