@@ -856,27 +856,30 @@ static int parser_dispstring(sfparse_parser *sfp, sfparse_value *dest) {
856856 case 0 :
857857 return SFPARSE_ERR_PARSE ;
858858 case 1 :
859- if (utf8state != UTF8_ACCEPT ) {
860- return SFPARSE_ERR_PARSE ;
861- }
862-
863859 ++ sfp -> pos ;
864860
865861 break ;
866862 case 2 :
867- ++ sfp -> pos ;
863+ for (;;) {
864+ ++ sfp -> pos ;
868865
869- if (sfp -> pos + 2 > sfp -> end ) {
870- return SFPARSE_ERR_PARSE ;
871- }
866+ if (sfp -> pos + 2 > sfp -> end || pctdecode ( & c , & sfp -> pos ) != 0 ) {
867+ return SFPARSE_ERR_PARSE ;
868+ }
872869
873- if (pctdecode (& c , & sfp -> pos ) != 0 ) {
874- return SFPARSE_ERR_PARSE ;
875- }
870+ utf8_decode (& utf8state , c );
871+ if (utf8state == UTF8_ACCEPT ) {
872+ if (sfp -> pos != sfp -> end && * sfp -> pos == '%' ) {
873+ continue ;
874+ }
876875
877- utf8_decode (& utf8state , c );
878- if (utf8state == UTF8_REJECT ) {
879- return SFPARSE_ERR_PARSE ;
876+ break ;
877+ }
878+
879+ if (utf8state == UTF8_REJECT || sfp -> pos + 1 > sfp -> end ||
880+ * sfp -> pos != '%' ) {
881+ return SFPARSE_ERR_PARSE ;
882+ }
880883 }
881884
882885 break ;
@@ -885,20 +888,23 @@ static int parser_dispstring(sfparse_parser *sfp, sfparse_value *dest) {
885888 return SFPARSE_ERR_PARSE ;
886889 }
887890
888- if (dest ) {
889- dest -> type = SFPARSE_TYPE_DISPSTRING ;
890- dest -> flags = SFPARSE_VALUE_FLAG_NONE ;
891- dest -> vec .len = (size_t )(sfp -> pos - base );
892- dest -> vec .base = dest -> vec .len == 0 ? NULL : (uint8_t * )base ;
893- }
894-
895- ++ sfp -> pos ;
896-
897- return 0 ;
891+ goto fin ;
898892 }
899893 }
900894
901895 return SFPARSE_ERR_PARSE ;
896+
897+ fin :
898+ if (dest ) {
899+ dest -> type = SFPARSE_TYPE_DISPSTRING ;
900+ dest -> flags = SFPARSE_VALUE_FLAG_NONE ;
901+ dest -> vec .len = (size_t )(sfp -> pos - base );
902+ dest -> vec .base = dest -> vec .len == 0 ? NULL : (uint8_t * )base ;
903+ }
904+
905+ ++ sfp -> pos ;
906+
907+ return 0 ;
902908}
903909
904910static const uint8_t bare_item_tbl [256 ] = {
0 commit comments