std::string::iterator OOB bug in form_urldecode

  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.
  Send mail to [email protected] for more info.

--269130843-1978073286-1081210219=:21911
Content-Type: TEXT/PLAIN; charset=US-ASCII

Hi,

Forgive me if someone has already reported this problem ...

My co-workers and I have come across an string::iterator oob problem
within the hex decoding portion of form_urldecode.

If a malformed hex number causes string::++ operator to abort due to
iterator extending past string::end(). Attached is a proposed fix I humbly
offer. Not only does the patch check that an out of boundary condition does
not exists, but it also verify that the digits following are hex control
characters as described by the HTML 1.1 spec on w3.org. When this
condition is not met (IE we don't get %[0-9a-fA-F][0-9a-fA-F]), the
default encoding of the '%' occurs.

Example:

a=blah% ... Behavior in 3.2.2 causes std::string to abort
a=blah% ... Patch behavior causes string to return 'blah%'

a=blah%zz ... Behavior in 3.2.2 causes std::string to return a wrapped number
a=blah%zz .. Patch behavior causes string to return 'blah%zz'

Near as I can tell, this is the best suited behavior that should happen,
also as a precedent, the patch provides the same behavior CGI.pm.

Thanks!

	Jim
--269130843-1978073286-1081210219=:21911
Content-Type: TEXT/PLAIN; charset=US-ASCII;
	name="CgiUtils-fix-iter-blowup.patch"
Content-Transfer-Encoding: BASE64
Content-ID: <[email protected]>
Content-Description: 
Content-Disposition: attachment; filename="CgiUtils-fix-iter-blowup.patch"

LS0tIENnaVV0aWxzLmNwcAlTdW4gSnVsIDEzIDA3OjIwOjM1IDIwMDMNCisr
KyBDZ2lVdGlscy5jcHAtTmV3CU1vbiBBcHIgIDUgMTY6MzQ6MDEgMjAwNA0K
QEAgLTE4MiwxMCArMTgyLDE2IEBADQogICAgICAgcmVzdWx0LmFwcGVuZCgx
LCAnICcpOw0KICAgICAgIGJyZWFrOw0KICAgICBjYXNlICclJzoNCi0gICAg
ICAvLyBhc3N1bWUgd2VsbC1mb3JtZWQgaW5wdXQNCisJICBpZiAoICggKCBp
dGVyICsgMSApICE9IHNyYy5lbmQoKSApICYmICggKCBpdGVyICsgMiApICE9
IHNyYy5lbmQoKSApDQorCQkmJiAoIGlzeGRpZ2l0KCAqKGl0ZXIgKyAxICkg
KSApICYmICggaXN4ZGlnaXQoICooaXRlciArIDIgKSApICkgKQ0KKwkgIHsN
CisJCS8vIG5ldmVyIGFzc3VtZSB3ZWxsLWZvcm1lZCBkYXRhIGZyb20gYW4g
b3V0c2lkZSBzb3VyY2UgOikNCisJCS8vIGh0dHA6Ly93d3cudzMub3JnL1By
b3RvY29scy9IVFRQLzEuMC9kcmFmdC1pZXRmLWh0dHAtc3BlYy5odG1sDQor
CQkvLyBlc2NhcGUgPSAiJXMiIEhFWCBIRVggd2hlcmUgSEVYID0gMC05YS1m
QS1GDQogICAgICAgYyA9ICorK2l0ZXI7DQogICAgICAgcmVzdWx0LmFwcGVu
ZCgxLCBoZXhUb0NoYXIoYywgKisraXRlcikpOw0KICAgICAgIGJyZWFrOw0K
KwkgIH0gLy8gaWYgaXQgZmFpbHMgdGhlIGFib3ZlIGNvbmRpdGlvbiwgbGV0
IGl0IHBhc3MgdGhyb3VnaCB0byB0aGUgZGVmYXVsdA0KICAgICBkZWZhdWx0
Og0KICAgICAgIHJlc3VsdC5hcHBlbmQoMSwgKml0ZXIpOw0KICAgICAgIGJy
ZWFrOw0K

--269130843-1978073286-1081210219=:21911
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
bug-cgicc mailing list
[email protected]
http://mail.gnu.org/mailman/listinfo/bug-cgicc

--269130843-1978073286-1081210219=:21911--