Fix #1424.

diff --git a/handler.c b/handler.c
index 4f18f7339743597f651d5ed16b89cffcf4e2d63c..d065c65e6805ad87def26204a255771921f65cee 100644 (file)
--- a/handler.c
+++ b/handler.c
@@ -296,8 +296,8 @@ void mutt_decode_base64 (STATE *s, long len, int istext, iconv_t cd)
     for (i = 0 ; i < 4 && len > 0 ; len--)
     {
       if ((ch = fgetc (s->fpin)) == EOF)
-       return;
-      if (!ISSPACE (ch))
+       break;
+      if (ch >= 0 && ch < 128 && (base64val(ch) != -1 || ch == '='))
        buf[i++] = ch;
     }
     if (i != 4)

diff --git a/rfc2047.c b/rfc2047.c
index 09214f956a798f08ee909f632ed1636177487eec..c0097b1bf241a45d8435c32914440345fd16fe02 100644 (file)
--- a/rfc2047.c
+++ b/rfc2047.c
@@ -583,10 +583,10 @@ void rfc2047_encode_adrlist (ADDRESS *addr, const char *tag)
 
 static int rfc2047_decode_word (char *d, const char *s, size_t len)
 {
-  const char *pp = s, *pp1;
+  const char *pp, *pp1;
   char *pd, *d0;
   const char *t, *t1;
-  int enc = 0, count = 0, c1, c2, c3, c4;
+  int enc = 0, count = 0;
   char *charset = NULL;
 
   pd = d0 = safe_malloc (strlen (s));
@@ -620,57 +620,43 @@ static int rfc2047_decode_word (char *d, const char *s, size_t len)
       case 4:
        if (enc == ENCQUOTEDPRINTABLE)
        {
-         while (pp < pp1 && len > 0)
+         for (; pp < pp1; pp++)
          {
            if (*pp == '_')
-           {
              *pd++ = ' ';
-             len--;
-           }
-           else if (*pp == '=')
+           else if (*pp == '=' &&
+                    (!(pp[1] & ~127) && hexval(pp[1]) != -1) &&
+                    (!(pp[2] & ~127) && hexval(pp[2]) != -1))
            {
-             if (pp[1] == 0 || pp[2] == 0)
-               break;  /* something wrong */
              *pd++ = (hexval(pp[1]) << 4) | hexval(pp[2]);
-             len--;
              pp += 2;
            }
            else
-           {
              *pd++ = *pp;
-             len--;
-           }
-           pp++;
          }
          *pd = 0;
        }
        else if (enc == ENCBASE64)
        {
-         while (pp < pp1 && len > 0)
-         {
-           if (pp[0] == '=' || pp[1] == 0 || pp[1] == '=')
-             break;  /* something wrong */
-           c1 = base64val(pp[0]);
-           c2 = base64val(pp[1]);
-           *pd++ = (c1 << 2) | ((c2 >> 4) & 0x3);
-           if (--len == 0) break;
-           
-           if (pp[2] == 0 || pp[2] == '=') break;
-
-           c3 = base64val(pp[2]);
-           *pd++ = ((c2 & 0xf) << 4) | ((c3 >> 2) & 0xf);
-           if (--len == 0)
-             break;
-
-           if (pp[3] == 0 || pp[3] == '=')
-             break;
+         int c, b = 0, k = 0;
 
-           c4 = base64val(pp[3]);
-           *pd++ = ((c3 & 0x3) << 6) | c4;
-           if (--len == 0)
+         for (; pp < pp1; pp++)
+         {
+           if (*pp == '=')
              break;
-
-           pp += 4;
+           if ((*pp & ~127) || (c = base64val(*pp)) == -1)
+             continue;
+           if (k + 6 >= 8)
+           {
+             k -= 2;
+             *pd++ = b | (c >> k);
+             b = c << (8 - k);
+           }
+           else
+           {
+             b |= c << (k + 2);
+             k += 6;
+           }
          }
          *pd = 0;
        }

diff --git a/url.c b/url.c
index 57e59f19e249dff4142ad075498d3f69748361b2..046151d02dfaa789878dd5f50951f22f4835df11 100644 (file)
--- a/url.c
+++ b/url.c
@@ -50,7 +50,8 @@ static void url_pct_decode (char *s)
   for (d = s; *s; s++)
   {
     if (*s == '%' && s[1] && s[2] &&
-       hexval (s[1]) >= 0 && hexval(s[2]) >= 0)
+       isxdigit (s[1]) && isxdigit (s[2]) &&
+       hexval (s[1]) >= 0 && hexval (s[2]) >= 0)
     {
       *d++ = (hexval (s[1]) << 4) | (hexval (s[2]));
       s += 2;