1 files changed, 10 insertions, 1 deletions
diff --git a/src/escape.c b/src/escape.c
index 1e56d77..7956017 100644
--- a/src/escape.c
+++ b/src/escape.c
@@ -76,7 +76,16 @@ static int dcs_decode_hex(const char *s, int len, char *out, int cap)
 {
     if (len & 1) return -1;
     int n = 0;
-    for (int i = 0; i < len; i += 2) {
+    int i = 0;
+    for (; i + 4 <= len; i += 4) {
+        int h0 = hex_val[(unsigned char)s[i]], l0 = hex_val[(unsigned char)s[i + 1]];
+        int h1 = hex_val[(unsigned char)s[i + 2]], l1 = hex_val[(unsigned char)s[i + 3]];
+        if ((h0 | l0 | h1 | l1) < 0 || n + 2 > cap) return -1;
+        out[n] = (char)(h0 << 4 | l0);
+        out[n + 1] = (char)(h1 << 4 | l1);
+        n += 2;
+    }
+    if (i < len) {
         int hi = hex_val[(unsigned char)s[i]], lo = hex_val[(unsigned char)s[i + 1]];
         if ((hi | lo) < 0 || n >= cap) return -1;
         out[n++] = (char)(hi << 4 | lo);