1 files changed, 8 insertions, 4 deletions

diff --git a/src/ot_urlencoded.c b/src/ot_urlencoded.c
index 4109bb5..c977adb 100644
--- a/src/ot_urlencoded.c
+++ b/src/ot_urlencoded.c
@@ -68,17 +68,18 @@ void urlencoded_skip_value(char **string) {
   *string = (char *)s;
 }
 
-int urlencoded_match_keyword(const ot_keywords *keywords, char **string, SCAN_SEARCHPATH_FLAG flags) {
+int urlencoded_match_keyword(const ot_keywords *keywords, char **string, const char *deststring_end, SCAN_SEARCHPATH_FLAG flags) {
   char   *deststring   = *string;
-  ssize_t match_length = urlencoded_parse(string, deststring, flags);
+  ssize_t match_length = urlencoded_parse(string, deststring, deststring_end, flags);
 
   if (match_length < 0)
     return match_length;
   if (match_length == 0)
     return -3;
 
+  /* Compare on the exact decoded length. */
   while (keywords->key) {
-    if (!strncmp(keywords->key, deststring, match_length) && !keywords->key[match_length])
+    if ((size_t)match_length == strlen(keywords->key) && !memcmp(keywords->key, deststring, (size_t)match_length))
       return keywords->value;
     keywords++;
   }
@@ -86,7 +87,7 @@ int urlencoded_match_keyword(const ot_keywords *keywords, char **string, SCAN_SE
   return -3;
 }
 
-ssize_t urlencoded_parse(char **string, char *deststring, SCAN_SEARCHPATH_FLAG flags) {
+ssize_t urlencoded_parse(char **string, char *deststring, const char *deststring_end, SCAN_SEARCHPATH_FLAG flags) {
   const unsigned char *s = *(const unsigned char **)string;
   unsigned char       *d = (unsigned char *)deststring;
   unsigned char        b, c;
@@ -106,6 +107,9 @@ ssize_t urlencoded_parse(char **string, char *deststring, SCAN_SEARCHPATH_FLAG f
       c |= (b << 4);
     }
 
+    if ((const char *)d >= deststring_end)
+      return -1;
+
     /* Write (possibly decoded) character to output */
     *d++ = c;
   }