#227 potential buffer overflow in cgi.c

[Charles Reiss]

unescape_url() in cgi.c does not handle the case where the string passed to it ends with '%' or '%x'; in those cases, it can jump over the \0 and over the end of supplied buffer.

(I do not have a demonstration of this bug that can actually be triggered remotely; however, it does appear that passing "%&" to http_formdata() (which presumably can be done with an appropriately constructed HTTP request) will overflow a buffer on the heap if malloc() returned non-zero'd memory.)

Patch included.

[Charles Reiss]

patch to cgi.c