commit: reject non-characters

diff --git a/commit.c b/commit.c
index 5097dba3928fe7ca19f0010cd1fe8db6fd5d3622..7dcfeea2d9f98b223d84f87f40901190dcb8b719 100644 (file)
--- a/commit.c
+++ b/commit.c
@@ -1305,8 +1305,11 @@ static int find_invalid_utf8(const char *buf, int len)
                /* Surrogates are only for UTF-16 and cannot be encoded in UTF-8. */
                if ((codepoint & 0x1ff800) == 0xd800)
                        return bad_offset;
-               /* U+FFFE and U+FFFF are guaranteed non-characters. */
-               if ((codepoint & 0x1ffffe) == 0xfffe)
+               /* U+xxFFFE and U+xxFFFF are guaranteed non-characters. */
+               if ((codepoint & 0xffffe) == 0xfffe)
+                       return bad_offset;
+               /* So are anything in the range U+FDD0..U+FDEF. */
+               if (codepoint >= 0xfdd0 && codepoint <= 0xfdef)
                        return bad_offset;
        }
        return -1;