1 files changed, 37 insertions, 4 deletions

diff --git a/src/bplist.c b/src/bplist.c
index 5db7096..d825fc8 100644
--- a/src/bplist.c
+++ b/src/bplist.c
@@ -286,15 +286,38 @@ static plist_t parse_string_node(char *bnode, uint64_t size)
 static char *plist_utf16_to_utf8(uint16_t *unistr, long len, long *items_read, long *items_written)
 {
         if (!unistr || (len <= 0)) return NULL;
-        char *outbuf = (char*)malloc(3*(len+1));
+        char *outbuf = (char*)malloc(4*(len+1));
         int p = 0;
         int i = 0;
 
         uint16_t wc;
+        uint32_t w;
+        int read_lead_surrogate = 0; 
 
         while (i < len) {
                 wc = unistr[i++];
-                if (wc >= 0x800) {
+                if (wc >= 0xD800 && wc <= 0xDBFF) {
+                        if (!read_lead_surrogate) {
+                                read_lead_surrogate = 1;
+                                w = 0x010000 + ((wc & 0x3FF) << 10);
+                        } else {
+                                // This is invalid, the next 16 bit char should be a trail surrogate. 
+                                // Handling error by skipping.
+                                read_lead_surrogate = 0;
+                        }
+                } else if (wc >= 0xDC00 && wc <= 0xDFFF) {
+                        if (read_lead_surrogate) {
+                                read_lead_surrogate = 0;
+                                w = w | (wc & 0x3FF);
+                                outbuf[p++] = (char)(0xF0 + ((w >> 18) & 0x3));
+                                outbuf[p++] = (char)(0x80 + ((w >> 12) & 0x3F));
+                                outbuf[p++] = (char)(0x80 + ((w >> 6) & 0x3F));
+                                outbuf[p++] = (char)(0x80 + (w & 0x3F));
+                        } else {
+                                // This is invalid.  A trail surrogate should always follow a lead surrogate.
+                                // Handling error by skipping
+                        }
+                } else if (wc >= 0x800) {
                         outbuf[p++] = (char)(0xE0 + ((wc >> 12) & 0xF));
                         outbuf[p++] = (char)(0x80 + ((wc >> 6) & 0x3F));
                         outbuf[p++] = (char)(0x80 + (wc & 0x3F));
@@ -988,19 +1011,29 @@ static int is_ascii_string(char* s, int len)
 
 uint16_t *plist_utf8_to_utf16(char *unistr, long size, long *items_read, long *items_written)
 {
-        uint16_t *outbuf = (uint16_t*)malloc((size+1)*sizeof(uint16_t));
+        uint16_t *outbuf = (uint16_t*)malloc(((size*2)+1)*sizeof(uint16_t));
         int p = 0;
         int i = 0;
 
         unsigned char c0;
         unsigned char c1;
         unsigned char c2;
+        unsigned char c3;
+
+        uint32_t w;
 
         while (i < size) {
                 c0 = unistr[i];
                 c1 = (i < size-1) ? unistr[i+1] : 0;
                 c2 = (i < size-2) ? unistr[i+2] : 0;
-                if ((c0 >= 0xE0) && (i < size-2) && (c1 >= 0x80) && (c2 >= 0x80)) {
+                c3 = (i < size-3) ? unistr[i+3] : 0;
+                if ((c0 >= 0xF0) && (i < size-3) && (c1 >= 0x80) && (c2 >= 0x80) && (c3 >= 0x80)) {
+                        // 4 byte sequence.  Need to generate UTF-16 surrogate pair
+                        w = ((((c0 & 7) << 18) + ((c1 & 0x3F) << 12) + ((c2 & 0x3F) << 6) + (c3 & 0x3F)) & 0x0FFFFF) - 0x010000;
+                        outbuf[p++] = 0xD800 + (w >> 10);
+                        outbuf[p++] = 0xDC00 + (w & 0x3FF);
+                        i+=4;
+                } else if ((c0 >= 0xE0) && (i < size-2) && (c1 >= 0x80) && (c2 >= 0x80)) {
                         // 3 byte sequence
                         outbuf[p++] = ((c2 & 0x3F) + ((c1 & 3) << 6)) + (((c1 >> 2) & 15) << 8) + ((c0 & 15) << 12);
                         i+=3;