Error in cgicc::form_urldecode

This is a multi-part message in MIME format.
--------------060907050101000904070303
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

There is an error in cgicc::form_urldecode.

When retrieving the two characters after a % sign, there is a
verification that the distance to the end is >= 2. But in the case it is
== 2, *(it + 2) is end() and so there is no valid character available.
The simple correction is to replace >= by >. A patch is attached.

I don't know if this is exploitable, I did not try.

Regards.

Julien BERNARD

PS: please cc me if you answer to this mail, I'm not on the list.

--------------060907050101000904070303
Content-Type: text/plain;
 name="distance.patch"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline;
 filename="distance.patch"

--- CgiUtils.cpp	2004-06-12 17:24:31.000000000 +0200
+++ CgiUtils.cpp.new	2006-08-30 00:06:39.000000000 +0200
@@ -182,11 +182,11 @@
     case '+':
       result.append(1, ' ');
       break;
     case '%':
 	// Don't assume well-formed input
-	if(std::distance(iter, src.end()) >= 2
+	if(std::distance(iter, src.end()) > 2
 	   && std::isxdigit(*(iter + 1)) && std::isxdigit(*(iter + 2))) {
 	    c = *++iter;
 	    result.append(1, hexToChar(c, *++iter));
 	}
 	// Just pass the % through untouched

--------------060907050101000904070303
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
bug-cgicc mailing list
[email protected]
http://lists.gnu.org/mailman/listinfo/bug-cgicc

--------------060907050101000904070303--

	
 p4.vert.ukl.yahoo.com uncompressed Tue Aug 29 21:27:01 GMT 2006 
	
		
___________________________________________________________________________ 
Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire.
http://fr.mail.yahoo.com