* new version 2.20.3

   * SMIME: If a message contains a RFC822 atachment that is
     signed/decrypted add the ability to view its SMIME information.

   * SMIME: The ^E command that gives information on the certificate
     is only available for messages that have a signed or encrypted part.

   * Fix vulnerability in regex library. This only affects those who use
     this library, such as the windows version of Alpine. See
     http://www.kb.cert.org/vuls/id/695940.

   * HTML: Add support for decoding entities in hexadecimal notation.
     Suggested by Tulipánt Gergely.

   * Pico: Add the ability to search for strings in the beginning or end
     of a line. In the search menu, pressing Ctrl-^ toggles the prompt
     to search for a string at the beginning of a line. Another press of
     Ctrl-^ toggles the prompt to search for a string at the end of a line,
     and pressing Ctrl-^ one more time searches for the string anywhere in
     the text.

1 files changed, 14 insertions, 4 deletions

diff --git a/pith/filter.c b/pith/filter.c
index 69413bf4..70a89f17 100644
--- a/pith/filter.c
+++ b/pith/filter.c
@@ -7743,6 +7743,9 @@ html_element_output(FILTER_S *f, int ch)
       html_output(f, ch);
 }
 
+#define ISHEX_DIGIT(X)	(isdigit((X)) || \
+			((X) >= 'a' && (X) <= 'f') || \
+			((X) >= 'A' && (X) <= 'F'))
 
 /*
  * collect html entity and return its UCS value when done.
@@ -7772,6 +7775,9 @@ html_entity_collector(FILTER_S *f, int ch, UCS *ucs, char **alt)
     else if((len == 0)
 	      ? (isalpha((unsigned char) ch) || ch == '#')
 	      : ((isdigit((unsigned char) ch)
+		  || (len == 1 && (unsigned char) ch == 'x')
+		  || (len == 1 &&(unsigned char) ch == 'X')
+		  || (len > 1 && isxdigit((unsigned char) ch))
 		  || (isalpha((unsigned char) ch) && buf[0] != '#')))){
 	buf[len++] = ch;
 	return(HTML_MOREDATA);
@@ -7779,14 +7785,18 @@ html_entity_collector(FILTER_S *f, int ch, UCS *ucs, char **alt)
     else if(ch == ';' || ASCII_ISSPACE((unsigned char) ch)){
 	buf[len] = '\0';		/* got something! */
 	if(buf[0] == '#'){
-	    *ucs = (UCS) strtoul(&buf[1], NULL, 10);
+	    if(buf[1] == 'x' || buf[1] == 'X')
+	       *ucs = (UCS) strtoul(&buf[2], NULL, 16);
+	    else
+	       *ucs = (UCS) strtoul(&buf[1], NULL, 10);
+
 	    if(alt){
 		*alt = NULL;
 		for(i = 0; i < sizeof(entity_tab)/sizeof(struct html_entities); i++)
-		  if(entity_tab[i].value == *ucs){
-		      *alt = entity_tab[i].plain;
+		   if(entity_tab[i].value == *ucs){
+		     *alt = entity_tab[i].plain;
 		      break;
-		  }
+		   }
 	    }
 
 	    len = 0;