Fix bounds-checking error in quoted-printable decoding loop.

diff --git a/quoted-printable.c b/quoted-printable.c
index b4ef5809c28ea4fb96c9b465a41ad7b7ce0cf2be..e078489f66e34e0ff7caaf5baf158e2f245dba6b 100644 (file)
--- a/quoted-printable.c
+++ b/quoted-printable.c
@@ -45,7 +45,7 @@ qp_decode(struct qp_state *qps, char *s, int len,
        char c;
        int ret = 0;
 
-       for (*olen = 0; len > 0 && size > 0; s++, len--, ret++) {
+       for (*olen = 0; len > 0 && *olen < size; s++, len--, ret++) {
                switch(qps->state) {
                case 0: 
                        if (*s == '=') {
@@ -54,7 +54,6 @@ qp_decode(struct qp_state *qps, char *s, int len,
                        else {
                                *out++ = *s;
                                (*olen)++;
-                               size --;
                        }
                        break;
                case 1: