From c8cf423eab6f260128859dfec991c36c54a3551c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ren=C3=A9=20Scharfe?= Date: Sat, 23 Sep 2017 20:04:40 +0200 Subject: mailinfo: don't decode invalid =XY quoted-printable sequences Decode =XY in quoted-printable segments only if X and Y are hexadecimal digits, otherwise just copy them. That's at least better than interpreting negative results from hexval() as a character. Reported-by: Jeff King Signed-off-by: Rene Scharfe Signed-off-by: Junio C Hamano --- mailinfo.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) (limited to 'mailinfo.c') diff --git a/mailinfo.c b/mailinfo.c index b4118a0275..5a597ef89c 100644 --- a/mailinfo.c +++ b/mailinfo.c @@ -367,11 +367,16 @@ static struct strbuf *decode_q_segment(const struct strbuf *q_seg, int rfc2047) while ((c = *in++) != 0) { if (c == '=') { - int d = *in++; + int ch, d = *in; if (d == '\n' || !d) break; /* drop trailing newline */ - strbuf_addch(out, (hexval(d) << 4) | hexval(*in++)); - continue; + ch = hex2chr(in); + if (ch >= 0) { + strbuf_addch(out, ch); + in += 2; + continue; + } + /* garbage -- fall through */ } if (rfc2047 && c == '_') /* rfc2047 4.2 (2) */ c = 0x20; -- cgit v1.2.3