X-Git-Url: http://git.indexdata.com/?p=yaz-moved-to-github.git;a=blobdiff_plain;f=src%2Furi.c;h=33120ed104b7bc4b3af66417022e0b51053f013e;hp=bae9a0a85860122839951a1ebf3f34a7f8b792f0;hb=cf0d647d4a642af04013d09f412e8629897187c5;hpb=5242cb5a8634bfa38b9333ff7f903e718ac6e292

diff --git a/src/uri.c b/src/uri.c
index bae9a0a..33120ed 100644
--- a/src/uri.c
+++ b/src/uri.c
@@ -1,5 +1,5 @@
 /* This file is part of the YAZ toolkit.
- * Copyright (C) 1995-2012 Index Data
+ * Copyright (C) 1995-2013 Index Data
  * See the file LICENSE for details.
  */
 /**
@@ -132,6 +132,13 @@ int yaz_uri_to_array(const char *path, ODR o, char ***name, char ***val)
     {
         cp++;
         no++;
+        while (*cp && *cp != '=' && *cp != '&')
+        {
+            /* check that x-form names looks sane */
+            if (*cp <= ' ' || *cp >= 127)
+                return 0;
+            cp++;
+        }
     }
     *name = (char **) odr_malloc(o, no * sizeof(char*));
     *val = (char **) odr_malloc(o, no * sizeof(char*));