From 92c27bbda9e809683537e5cc48adad0d5c390587 Mon Sep 17 00:00:00 2001 From: Dirk Engling Date: Fri, 6 Nov 2026 18:27:44 +0100 Subject: Gives urlencoded_parse a destination bound --- src/ot_urlencoded.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'src/ot_urlencoded.c') diff --git a/src/ot_urlencoded.c b/src/ot_urlencoded.c index 4109bb5..c977adb 100644 --- a/src/ot_urlencoded.c +++ b/src/ot_urlencoded.c @@ -68,17 +68,18 @@ void urlencoded_skip_value(char **string) { *string = (char *)s; } -int urlencoded_match_keyword(const ot_keywords *keywords, char **string, SCAN_SEARCHPATH_FLAG flags) { +int urlencoded_match_keyword(const ot_keywords *keywords, char **string, const char *deststring_end, SCAN_SEARCHPATH_FLAG flags) { char *deststring = *string; - ssize_t match_length = urlencoded_parse(string, deststring, flags); + ssize_t match_length = urlencoded_parse(string, deststring, deststring_end, flags); if (match_length < 0) return match_length; if (match_length == 0) return -3; + /* Compare on the exact decoded length. */ while (keywords->key) { - if (!strncmp(keywords->key, deststring, match_length) && !keywords->key[match_length]) + if ((size_t)match_length == strlen(keywords->key) && !memcmp(keywords->key, deststring, (size_t)match_length)) return keywords->value; keywords++; } @@ -86,7 +87,7 @@ int urlencoded_match_keyword(const ot_keywords *keywords, char **string, SCAN_SE return -3; } -ssize_t urlencoded_parse(char **string, char *deststring, SCAN_SEARCHPATH_FLAG flags) { +ssize_t urlencoded_parse(char **string, char *deststring, const char *deststring_end, SCAN_SEARCHPATH_FLAG flags) { const unsigned char *s = *(const unsigned char **)string; unsigned char *d = (unsigned char *)deststring; unsigned char b, c; @@ -106,6 +107,9 @@ ssize_t urlencoded_parse(char **string, char *deststring, SCAN_SEARCHPATH_FLAG f c |= (b << 4); } + if ((const char *)d >= deststring_end) + return -1; + /* Write (possibly decoded) character to output */ *d++ = c; } -- cgit v1.3