Commit b734bc37 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

curl_unescape() did not stop at the set length properly when %-codes were 

used
parent 2c123051

lib/escape.c

+2 −1
Original line number Diff line number Diff line
@@ -100,7 +100,7 @@ char *curl_unescape(char *string, int length) 
                            the "query part" where '+' should become ' '.

                            RFC 2316, section 3.10 */

  

   while(--alloc) {

   while(--alloc > 0) {

      in = *string;

      if(querypart && ('+' == in))

         in = ' ';
@@ -113,6 +113,7 @@ char *curl_unescape(char *string, int length) 
        if(sscanf(string+1, "%02X", &hex)) {

          in = hex;

          string+=2;

          alloc-=2;

        }

      }