fix buffer overrun

commit_hash:013178051e5e4c0a99ded31893069fb928ba18f9

2 files changed, 7 insertions, 9 deletions

diff --git a/library/cpp/string_utils/quote/quote.cpp b/library/cpp/string_utils/quote/quote.cpp
index 6a117c424af..9559132ae6f 100644
--- a/library/cpp/string_utils/quote/quote.cpp
+++ b/library/cpp/string_utils/quote/quote.cpp
@@ -274,12 +274,11 @@ TString UrlUnescapeRet(const TStringBuf from) {
     return to;
 }
 
-char* UrlEscape(char* to, const char* from, bool forceEscape) {
-    from = FixZero(from);
-
-    while (*from) {
+char* UrlEscape(char* to, TStringBuf src, bool forceEscape) {
+    for (auto from = src.begin(); from != src.end(); ++from) {
         const bool escapePercent = (*from == '%') &&
-                                   (forceEscape || !((*(from + 1) && IsAsciiHex(*(from + 1)) && *(from + 2) && IsAsciiHex(*(from + 2)))));
+                                   (forceEscape || !((std::next(from) != src.end() && IsAsciiHex(*(std::next(from)))
+                                   && std::next(from, 2) != src.end() && IsAsciiHex(*(std::next(from, 2))))));
 
         if (escapePercent || (unsigned char)*from <= ' ' || (unsigned char)*from > '~') {
             *to++ = '%';
@@ -287,7 +286,6 @@ char* UrlEscape(char* to, const char* from, bool forceEscape) {
             *to++ = d2x((unsigned char)*from & 0xF);
         } else
             *to++ = *from;
-        ++from;
     }
 
     *to = 0;
@@ -298,12 +296,12 @@ char* UrlEscape(char* to, const char* from, bool forceEscape) {
 void UrlEscape(TString& url, bool forceEscape) {
     TTempBuf tempBuf(CgiEscapeBufLen(url.size()));
     char* to = tempBuf.Data();
-    url.AssignNoAlias(to, UrlEscape(to, url.data(), forceEscape));
+    url.AssignNoAlias(to, UrlEscape(to, url, forceEscape));
 }
 
 TString UrlEscapeRet(const TStringBuf from, bool forceEscape) {
     TString to;
     to.ReserveAndResize(CgiEscapeBufLen(from.size()));
-    to.resize(UrlEscape(to.begin(), from.begin(), forceEscape) - to.data());
+    to.resize(UrlEscape(to.begin(), from, forceEscape) - to.data());
     return to;
 }
diff --git a/library/cpp/string_utils/quote/quote.h b/library/cpp/string_utils/quote/quote.h
index 3b7221154eb..d99c08dfb39 100644
--- a/library/cpp/string_utils/quote/quote.h
+++ b/library/cpp/string_utils/quote/quote.h
@@ -51,7 +51,7 @@ void Quote(TString& url, const char* safe = "/");
 // escapes only '%' not followed by two hex-digits or if forceEscape set to ture,
 // and chars outside [32, 126] range.
 // Can't handle '\0'-chars in TString.
-char* UrlEscape(char* to, const char* from, bool forceEscape = false);
+char* UrlEscape(char* to, TStringBuf from, bool forceEscape = false);
 void UrlEscape(TString& url, bool forceEscape = false);
 TString UrlEscapeRet(const TStringBuf from, bool forceEscape = false);