From 7810f2e04bf77410b0d0797641bc1fe6daa1259b Mon Sep 17 00:00:00 2001 From: deraadt Date: Mon, 29 Mar 2021 03:34:52 +0000 Subject: [PATCH] in unsafe_char(), handle %NN with array-index inspection rather than weird ptr++ ok claudio --- usr.bin/ftp/fetch.c | 4 ++-- usr.sbin/rpki-client/http.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/usr.bin/ftp/fetch.c b/usr.bin/ftp/fetch.c index b50040dad7c..7a29dfb60d5 100644 --- a/usr.bin/ftp/fetch.c +++ b/usr.bin/ftp/fetch.c @@ -1,4 +1,4 @@ -/* $OpenBSD: fetch.c,v 1.203 2021/03/13 11:36:31 sthen Exp $ */ +/* $OpenBSD: fetch.c,v 1.204 2021/03/29 03:34:52 deraadt Exp $ */ /* $NetBSD: fetch.c,v 1.14 1997/08/18 10:20:20 lukem Exp $ */ /*- @@ -128,7 +128,7 @@ unsafe_char(const char *c0) * hexadecimal digits. */ strchr(unsafe_chars, *c) != NULL || - (*c == '%' && (!isxdigit(*++c) || !isxdigit(*++c)))); + (*c == '%' && (!isxdigit(c[1]) || !isxdigit(c[2])))); } /* diff --git a/usr.sbin/rpki-client/http.c b/usr.sbin/rpki-client/http.c index 8f49b745946..a3c4cbb9a66 100644 --- a/usr.sbin/rpki-client/http.c +++ b/usr.sbin/rpki-client/http.c @@ -1,4 +1,4 @@ -/* $OpenBSD: http.c,v 1.9 2021/03/25 12:18:45 claudio Exp $ */ +/* $OpenBSD: http.c,v 1.10 2021/03/29 03:34:52 deraadt Exp $ */ /* * Copyright (c) 2020 Nils Fisher * Copyright (c) 2020 Claudio Jeker @@ -168,7 +168,7 @@ unsafe_char(const char *c0) * hexadecimal digits. */ strchr(unsafe_chars, *c) != NULL || - (*c == '%' && (!isxdigit(*++c) || !isxdigit(*++c)))); + (*c == '%' && (!isxdigit(c[1]) || !isxdigit(c[2])))); } /* -- 2.20.1