Fix format_uri().

It was using the same index into the input and output strings, which
means that if it escaped any character, it would skip the next two
characters in the input sring.

It was also not clearing is_reserved before testing whether a character
was reserved, so once it saw a character that neede dto be escaped, it
would escape all subsequent characters.

It was only used in get_key_string(), which was never used, so it was
dead code, but let's at least fix it, even if we end up removing that
code, so that if we bring it back, we bring back a non-broken version,
and so that if anybody *else* uses it, it's not broken.

Change-Id: I36588efad36908e012023bcfbd813c749a6a254f
Reviewed-on: https://code.wireshark.org/review/33287
Petri-Dish: Guy Harris <guy@alum.mit.edu>
Tested-by: Petri Dish Buildbot
Reviewed-by: Guy Harris <guy@alum.mit.edu>

1 files changed, 12 insertions, 8 deletions

diff --git a/epan/strutil.c b/epan/strutil.c
index 0a31750e73..d8187674d6 100644
--- a/epan/strutil.c
+++ b/epan/strutil.c
@@ -685,7 +685,7 @@ format_uri(wmem_allocator_t* allocator, const GByteArray *bytes, const gchar *re
     static const guchar *reserved_def = ":/?#[]@!$&'()*+,;= ";
     const guchar *reserved = reserved_def;
     guint8 c;
-    guint column, i;
+    guint byte_index, column, i;
     gboolean is_reserved = FALSE;
 
     if (! bytes)
@@ -694,7 +694,8 @@ format_uri(wmem_allocator_t* allocator, const GByteArray *bytes, const gchar *re
     if (reserved_chars)
         reserved = reserved_chars;
 
-    for (column = 0; column < bytes->len; column++) {
+    column = 0;
+    for (byte_index = 0; byte_index < bytes->len; byte_index++) {
         /*
          * Is there enough room for this character, if it expands to
          * a percent plus 2 hex digits (which is the most it can
@@ -710,25 +711,28 @@ format_uri(wmem_allocator_t* allocator, const GByteArray *bytes, const gchar *re
             fmtbuf_len *= 2;
             fmtbuf = (gchar *)wmem_realloc(allocator, fmtbuf, fmtbuf_len);
         }
-        c = bytes->data[column];
+        c = bytes->data[byte_index];
 
+        is_reserved = FALSE;
         if (!g_ascii_isprint(c) || c == '%') {
             is_reserved = TRUE;
-        }
-
-        for (i = 0; reserved[i]; i++) {
-            if (c == reserved[i])
-                is_reserved = TRUE;
+        } else {
+            for (i = 0; reserved[i]; i++) {
+                if (c == reserved[i])
+                    is_reserved = TRUE;
+            }
         }
 
         if (!is_reserved) {
             fmtbuf[column] = c;
+            column++;
         } else {
             fmtbuf[column] = '%';
             column++;
             fmtbuf[column] = hex[c >> 4];
             column++;
             fmtbuf[column] = hex[c & 0xF];
+            column++;
         }
     }
     fmtbuf[column] = '\0';