From a4e5af66f1bd5c460ed7bc48bc09ce30a39f1bcc Mon Sep 17 00:00:00 2001
From: Adrien Destugues <pulkomandy@pulkomandy.tk>
Date: Mon, 4 Aug 2014 16:52:40 +0200
Subject: [PATCH] Make URL decoding even more solid.

* Thanks to korli for pointing remaining issues.
---
 src/kits/network/libnetapi/Url.cpp | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/src/kits/network/libnetapi/Url.cpp b/src/kits/network/libnetapi/Url.cpp
index 868d6fc029..3bfd4e31a5 100644
--- a/src/kits/network/libnetapi/Url.cpp
+++ b/src/kits/network/libnetapi/Url.cpp
@@ -1005,23 +1005,22 @@ BUrl::_DoUrlDecodeChunk(const BString& chunk, bool strict)
 		if (chunk[i] == '+' && !strict)
 			result << ' ';
 		else {
-			bool isEncoded = false;
 			char decoded = 0;
+			char* out = NULL;
+			char hexString[3];
 
-			if (chunk[i] == '%' && i < chunk.Length() - 2)
-			{
-				char hexString[] = { chunk[i + 1], chunk[i + 2], 0 };
-				char* out = NULL;
+			if (chunk[i] == '%' && i < chunk.Length() - 2
+				&& isxdigit(chunk[i + 1]) && isxdigit(chunk[i+2])) {
+				hexString[0] = chunk[i + 1];
+				hexString[1] = chunk[i + 2];
+				hexString[2] = 0;
 				decoded = (char)strtol(hexString, &out, 16);
-				if (out == hexString + 2) {
-					isEncoded = true;
-					i += 2;
-				}
 			}
 
-			if (isEncoded)
+			if (out == hexString + 2) {
+				i += 2;
 				result << decoded;
-			else
+			} else
 				result << chunk[i];
 		} 
 	}