{"thread":{"id":"46817","subject":"[PATCH] mailinfo: don't decode invalid =XY quoted-printable sequences","startedAt":"2017-09-23T18:05:02Z","lastAt":"2017-09-25T12:28:54Z","messageCount":3,"participants":["René Scharfe","Jeff King"],"isPatch":true,"patchVersion":1,"patchTotal":null},"messages":[{"id":"328735","messageId":"d48b3d67-5f03-19f3-5a32-ec7e8397c98d@web.de","threadId":"46817","inReplyTo":null,"subject":"[PATCH] mailinfo: don't decode invalid =XY quoted-printable sequences","fromName":"René Scharfe","fromEmail":"l.s.r@web.de","sentAt":"2017-09-23T18:04:40Z","receivedAt":"2017-09-23T18:05:02Z","isPatch":true,"sender":{"key":"l.s.r@web.de","avatar":"https://avatars.githubusercontent.com/u/26122331?v=4"},"body":"Decode =XY in quoted-printable segments only if X and Y are hexadecimal\ndigits, otherwise just copy them.  That's at least better than\ninterpreting negative results from hexval() as a character.\n\nSigned-off-by: Rene Scharfe <l.s.r@web.de>\n---\n mailinfo.c | 11 ++++++++---\n 1 file changed, 8 insertions(+), 3 deletions(-)\n\ndiff --git a/mailinfo.c b/mailinfo.c\nindex f2387a3267..3d8ac07399 100644\n--- a/mailinfo.c\n+++ b/mailinfo.c\n@@ -367,11 +367,16 @@ static struct strbuf *decode_q_segment(const struct strbuf *q_seg, int rfc2047)\n \n \twhile ((c = *in++) != 0) {\n \t\tif (c == '=') {\n-\t\t\tint d = *in++;\n+\t\t\tint ch, d = *in;\n \t\t\tif (d == '\\n' || !d)\n \t\t\t\tbreak; /* drop trailing newline */\n-\t\t\tstrbuf_addch(out, (hexval(d) << 4) | hexval(*in++));\n-\t\t\tcontinue;\n+\t\t\tch = hex2chr(in);\n+\t\t\tif (ch >= 0) {\n+\t\t\t\tstrbuf_addch(out, ch);\n+\t\t\t\tin += 2;\n+\t\t\t\tcontinue;\n+\t\t\t}\n+\t\t\t/* garbage -- fall through */\n \t\t}\n \t\tif (rfc2047 && c == '_') /* rfc2047 4.2 (2) */\n \t\t\tc = 0x20;\n-- \n2.14.1\n"},{"id":"328736","messageId":"f06d0701-281c-07eb-d053-78b8fcdd00c4@web.de","threadId":"46817","inReplyTo":"d48b3d67-5f03-19f3-5a32-ec7e8397c98d@web.de","subject":"Re: [PATCH] mailinfo: don't decode invalid =XY quoted-printable sequences","fromName":"René Scharfe","fromEmail":"l.s.r@web.de","sentAt":"2017-09-23T18:36:10Z","receivedAt":"2017-09-23T18:36:29Z","isPatch":true,"sender":{"key":"l.s.r@web.de","avatar":"https://avatars.githubusercontent.com/u/26122331?v=4"},"body":"Am 23.09.2017 um 20:04 schrieb René Scharfe:\n> Decode =XY in quoted-printable segments only if X and Y are hexadecimal\n> digits, otherwise just copy them.  That's at least better than\n> interpreting negative results from hexval() as a character.\n\nForgot to add:\n\nReported-by: Jeff King <peff@peff.net>\n\nRené\n"},{"id":"328843","messageId":"20170925122844.lwzwtp2u4dhgijrd@sigill.intra.peff.net","threadId":"46817","inReplyTo":"d48b3d67-5f03-19f3-5a32-ec7e8397c98d@web.de","subject":"Re: [PATCH] mailinfo: don't decode invalid =XY quoted-printable sequences","fromName":"Jeff King","fromEmail":"peff@peff.net","sentAt":"2017-09-25T12:28:44Z","receivedAt":"2017-09-25T12:28:54Z","isPatch":true,"sender":{"key":"peff@peff.net","avatar":"https://avatars.githubusercontent.com/u/45925?v=4"},"body":"On Sat, Sep 23, 2017 at 08:04:40PM +0200, René Scharfe wrote:\n\n> Decode =XY in quoted-printable segments only if X and Y are hexadecimal\n> digits, otherwise just copy them.  That's at least better than\n> interpreting negative results from hexval() as a character.\n\nThanks, this looks good to me overall.\n\nI wondered if we should die() here, but walking over cruft may be more\nfriendly. The base64 case does the same, though it actually ignores the\nbytes rather than copying them. Since this is never _supposed_ to\nhappen, it's hard to say what behavior would be preferable without\nseeing a real-world broken case.\n\n-Peff\n"}]}