1 files changed, 30 insertions, 26 deletions

diff --git a/src/core/ngx_string.c b/src/core/ngx_string.c
index c9193152c..64ba703b7 100644
--- a/src/core/ngx_string.c
+++ b/src/core/ngx_string.c
@@ -955,7 +955,7 @@ ngx_decode_base64(ngx_str_t *dst, ngx_str_t *src)
  * ngx_utf_decode() decodes two and more bytes UTF sequences only
  * the return values:
  *    0x80 - 0x10ffff         valid character
- *    0x10ffff - 0xfffffffd   invalid sequence
+ *    0x110000 - 0xfffffffd   invalid sequence
  *    0xfffffffe              incomplete sequence
  *    0xffffffff              error
  */
@@ -1020,29 +1020,24 @@ ngx_utf_decode(u_char **p, size_t n)
 size_t
 ngx_utf_length(u_char *p, size_t n)
 {
-    u_char      c;
-    size_t      len;
-    ngx_uint_t  i;
+    u_char  c, *last;
+    size_t  len;
 
-    for (len = 0, i = 0; i < n; len++, i++) {
+    last = p + n;
 
-        c = p[i];
+    for (len = 0; p < last; len++) {
+
+        c = *p;
 
         if (c < 0x80) {
+            p++;
             continue;
         }
 
-        if (c >= 0xc0) {
-            for (c <<= 1; c & 0x80; c <<= 1) {
-                i++;
-            }
-
-            continue;
+        if (ngx_utf_decode(&p, n) > 0x10ffff) {
+            /* invalid utf */
+            return n;
         }
-
-        /* invalid utf */
-
-        return n;
     }
 
     return len;
@@ -1050,36 +1045,45 @@ ngx_utf_length(u_char *p, size_t n)
 
 
 u_char *
-ngx_utf_cpystrn(u_char *dst, u_char *src, size_t n)
+ngx_utf_cpystrn(u_char *dst, u_char *src, size_t n, size_t len)
 {
-    u_char  c;
+    u_char  c, *next;
 
     if (n == 0) {
         return dst;
     }
 
-    for ( /* void */ ; --n; dst++, src++) {
+    while (--n) {
 
         c = *src;
         *dst = c;
 
         if (c < 0x80) {
-            if (*dst != '\0') {
+
+            if (c != '\0') {
+                dst++;
+                src++;
+                len--;
+
                 continue;
             }
 
             return dst;
         }
 
-        if (c >= 0xc0) {
-            for (c <<= 1; c & 0x80; c <<= 1) {
-               *++dst = *++src;
-            }
+        next = src;
 
-            continue;
+        if (ngx_utf_decode(&next, len) > 0x10ffff) {
+            /* invalid utf */
+            break;
         }
 
-        /* invalid utf */
+        len--;
+
+        while (src < next) {
+            *++dst = *++src;
+            len--;
+        }
     }
 
     *dst = '\0';