@@ -1482,15 +1482,21 @@ int js_decode_nonstrict_inplace(unsigned char *input, long int input_len) {
14821482 {
14831483/* \uHHHH */
14841484
1485- /* Use only the lower byte. */
1486- * d = x2c (& input [i + 4 ]);
1485+ unsignedchar lowestByte = x2c (& input [i + 4 ]);
14871486
1488- /* Full width ASCII (ff01 - ff5e) needs 0x20 added */
1489- if ( (* d > 0x00 )&& (* d < 0x5f )
1487+ if ((lowestByte > 0x00 )&& (lowestByte < 0x5f )
14901488&& ((input [i + 2 ]== 'f' )|| (input [i + 2 ]== 'F' ))
14911489&& ((input [i + 3 ]== 'f' )|| (input [i + 3 ]== 'F' )))
14921490 {
1493- (* d )+= 0x20 ;
1491+ /* Full width ASCII (ff01 - ff5e) needs 0x20 added. */
1492+ /* This is because the first printable char in ASCII is 0x20, and corresponds to 0xFF00. */
1493+ * d = lowestByte + 0x20 ;
1494+ }
1495+ else
1496+ {
1497+ /* There was no good ASCII character to map this unicode character to. */
1498+ /* Put a placeholder that is hopefully as innocent as the unicode character. */
1499+ * d = 'x' ;
14941500 }
14951501
14961502d ++ ;
@@ -1633,15 +1639,21 @@ int urldecode_uni_nonstrict_inplace_ex(unsigned char *input, long int input_len,
16331639if (hmap != -1 ) {
16341640* d = hmap ;
16351641 }else {
1636- /* We first make use of the lower byte here, ignoring the higher byte. */
1637- * d = x2c (& input [i + 4 ]);
1642+ unsignedchar lowestByte = x2c (& input [i + 4 ]);
16381643
1639- /* Full width ASCII (ff01 - ff5e) needs 0x20 added */
1640- if ( (* d > 0x00 )&& (* d < 0x5f )
1641- && ((input [i + 2 ]== 'f' )|| (input [i + 2 ]== 'F' ))
1642- && ((input [i + 3 ]== 'f' )|| (input [i + 3 ]== 'F' )))
1644+ if ((lowestByte > 0x00 )&& (lowestByte < 0x5f )
1645+ && ((input [i + 2 ]== 'f' )|| (input [i + 2 ]== 'F' ))
1646+ && ((input [i + 3 ]== 'f' )|| (input [i + 3 ]== 'F' )))
1647+ {
1648+ /* Full width ASCII (ff01 - ff5e) needs 0x20 added. */
1649+ /* This is because the first printable char in ASCII is 0x20, and corresponds to 0xFF00. */
1650+ * d = lowestByte + 0x20 ;
1651+ }
1652+ else
16431653 {
1644- (* d )+= 0x20 ;
1654+ /* There was no good ASCII character to map this unicode character to. */
1655+ /* Put a placeholder that is hopefully as innocent as the unicode character. */
1656+ * d = 'x' ;
16451657 }
16461658 }
16471659d ++ ;