compat_urllib_parse_unquote: crash fix: only decode valid hex

[youtube-dl] / youtube_dl / compat.py

diff --git a/youtube_dl/compat.py b/youtube_dl/compat.py
index c3783337a5a801cd5230f2ae2f5d82112d4b6cea..1f4ccf443214d322121938cca58150f9aaa8803f 100644 (file)
--- a/youtube_dl/compat.py
+++ b/youtube_dl/compat.py
@@ -94,6 +94,8 @@ except ImportError:
             try:
                 if not item:
                     raise ValueError
+                if not re.match('[0-9a-fA-F][0-9a-fA-F]',item[:2]):
+                    raise ValueError
                 pct_sequence += item[:2].decode('hex')
                 rest = item[2:]
                 if not rest: