summaryrefslogtreecommitdiffabout
authorMark Lodato <lodatom@gmail.com>2010-08-28 01:02:27 (UTC)
committer Lars Hjemli <hjemli@gmail.com>2010-08-29 15:27:40 (UTC)
commit48434780ca62fde84337ea1e797f642de5ca50d5 (patch) (side-by-side diff)
treead6a67137124a5ae70de10dd29e84bd6bf21c6ea
parentc94414a4c8cd099f5737e8b4066693d07ce78f61 (diff)
downloadcgit-48434780ca62fde84337ea1e797f642de5ca50d5.zip
cgit-48434780ca62fde84337ea1e797f642de5ca50d5.tar.gz
cgit-48434780ca62fde84337ea1e797f642de5ca50d5.tar.bz2
html: fix strcpy bug in convert_query_hexchar
The source and destination strings in strcpy() may not overlap. Instead, use memmove(), which allows overlap. This fixes test t0104, where 'url=foo%2bbar/tree' was being parsed improperly. Signed-off-by: Mark Lodato <lodatom@gmail.com>
Diffstat (more/less context) (ignore whitespace changes)
-rw-r--r--html.c9
1 files changed, 5 insertions, 4 deletions
diff --git a/html.c b/html.c
index 66ba65d..d86b2c1 100644
--- a/html.c
+++ b/html.c
@@ -237,25 +237,26 @@ int hextoint(char c)
else
return -1;
}
char *convert_query_hexchar(char *txt)
{
- int d1, d2;
- if (strlen(txt) < 3) {
+ int d1, d2, n;
+ n = strlen(txt);
+ if (n < 3) {
*txt = '\0';
return txt-1;
}
d1 = hextoint(*(txt+1));
d2 = hextoint(*(txt+2));
if (d1<0 || d2<0) {
- strcpy(txt, txt+3);
+ memmove(txt, txt+3, n-3);
return txt-1;
} else {
*txt = d1 * 16 + d2;
- strcpy(txt+1, txt+3);
+ memmove(txt+1, txt+3, n-2);
return txt;
}
}
int http_parse_querystring(char *txt, void (*fn)(const char *name, const char *value))
{