A fix in decodeURI() function.

diff --git a/njs/njs_string.c b/njs/njs_string.c
index 5a0d550475a5fcee61e49df84b26802e2c3d21fe..d47d6b496fa9e97c57cf8c3c0c78102a77b0b0dd 100644 (file)
--- a/njs/njs_string.c
+++ b/njs/njs_string.c
@@ -2355,7 +2355,10 @@ njs_string_decode(njs_vm_t *vm, njs_value_t *value, const uint32_t *reserve)
         byte = *src++;
 
         if (byte == '%') {
-            if (size < 3) {
+
+            size -= 2;
+
+            if (size == 0) {
                 goto uri_error;
             }
 
@@ -2372,7 +2375,6 @@ njs_string_decode(njs_vm_t *vm, njs_value_t *value, const uint32_t *reserve)
             byte = (d0 << 4) + d1;
 
             if ((reserve[byte >> 5] & ((uint32_t) 1 << (byte & 0x1f))) == 0) {
-                size -= 2;
                 n += 2;
             }
         }