Fix security issue.

Change-Id: I9c76f09bdb4a0fdb2cb471b2a3c8125ac65f2c86
Signed-off-by: min7.choi <min7.choi@samsung.com>

diff --git a/agent/download-agent-encoding.c b/agent/download-agent-encoding.c
index 3f14fca..cf187b7 100755 (executable)
--- a/agent/download-agent-encoding.c
+++ b/agent/download-agent-encoding.c
@@ -17,6 +17,7 @@
 #include <string.h>
 #include <stdlib.h>
 #include "glib.h"
+#include <curl/curl.h>
 
 #include "download-agent-debug.h"
 #include "download-agent-encoding.h"
@@ -232,30 +233,14 @@ ERR:
 
 void decode_url_encoded_str(const char *in_encoded_str, char **out_str)
 {
-       char *in = NULL;
-       char *out = NULL;
-       *out_str = calloc(1, strlen(in_encoded_str) + 1);
-       if (*out_str == NULL)
+       CURL* curl = curl_easy_init();
+
+       *out_str = curl_easy_unescape(curl, in_encoded_str, strlen(in_encoded_str), NULL);
+
+       if(!*out_str){
+               DA_LOGE("CURLE_OUT_OF_MEMORY");
                return;
-    out = *out_str;
-    in = (char *)in_encoded_str;
-       while (*in)
-       {
-               if (*in == '%') {
-                       int hex = 0;
-                       in++;
-                       if (sscanf(in, "%2x", &hex) <= 0) {
-                               return;
-                       } else {
-                               *out = hex;
-                               in++;
-                       }
-               } else if (*in == '+') {
-                       *out = ' ';
-               } else {
-                       *out = *in;
-               }
-               in++;
-               out++;
        }
+
+       curl_easy_cleanup(curl);
 }

diff --git a/packaging/download-provider.spec b/packaging/download-provider.spec
index eb7e2c3..5af1f3a 100755 (executable)
--- a/packaging/download-provider.spec
+++ b/packaging/download-provider.spec
@@ -1,7 +1,7 @@
 %define _ux_define tizen2.3
 Name:       download-provider
 Summary:    Download the contents in background
-Version:    2.1.73
+Version:    2.1.74
 Release:    0
 Group:      Development/Libraries
 License:    Apache-2.0