adf970c
--- src/codecs/qutfcodec.cpp
adf970c
+++ src/codecs/qutfcodec.cpp
adf970c
@@ -154,6 +154,7 @@
adf970c
 
adf970c
 class QUtf8Decoder : public QTextDecoder {
adf970c
     uint uc;
adf970c
+    uint min_uc;
adf970c
     int need;
adf970c
     bool headerDone;
adf970c
 public:
adf970c
@@ -167,8 +168,9 @@
adf970c
 	result.setLength( len ); // worst case
adf970c
 	QChar *qch = (QChar *)result.unicode();
adf970c
 	uchar ch;
adf970c
+        int error = -1;
adf970c
 	for (int i=0; i
adf970c
-	    ch = *chars++;
adf970c
+	    ch = chars[i];
adf970c
 	    if (need) {
adf970c
 		if ( (ch&0xc0) == 0x80 ) {
adf970c
 		    uc = (uc << 6) | (ch & 0x3f);
adf970c
@@ -182,6 +184,8 @@
adf970c
 			    *qch++ = QChar(high);
adf970c
 			    *qch++ = QChar(low);
adf970c
 			    headerDone = TRUE;
adf970c
+			} else if ((uc < min_uc) || (uc >= 0xd800 && uc <= 0xdfff) || (uc >= 0xfffe)) {
adf970c
+                            *qch++ = QChar::replacement;
adf970c
 			} else {
adf970c
 			    if (headerDone || QChar(uc) != QChar::byteOrderMark)
adf970c
 				*qch++ = uc;
adf970c
@@ -190,6 +194,7 @@
adf970c
 		    }
adf970c
 		} else {
adf970c
 		    // error
adf970c
+                    i = error;
adf970c
 		    *qch++ = QChar::replacement;
adf970c
 		    need = 0;
adf970c
 		}
adf970c
@@ -200,12 +205,21 @@
adf970c
 		} else if ((ch & 0xe0) == 0xc0) {
adf970c
 		    uc = ch & 0x1f;
adf970c
 		    need = 1;
adf970c
+                    error = i;
adf970c
+		    min_uc = 0x80;
adf970c
 		} else if ((ch & 0xf0) == 0xe0) {
adf970c
 		    uc = ch & 0x0f;
adf970c
 		    need = 2;
adf970c
+                    error = i;
adf970c
+		    min_uc = 0x800;
adf970c
 		} else if ((ch&0xf8) == 0xf0) {
adf970c
 		    uc = ch & 0x07;
adf970c
 		    need = 3;
adf970c
+                    error = i;
adf970c
+                    min_uc = 0x10000;
adf970c
+                } else {
adf970c
+                    // error
adf970c
+                    *qch++ = QChar::replacement;
adf970c
 		}
adf970c
 	    }
adf970c
 	}
adf970c
--- src/tools/qstring.cpp
adf970c
+++ src/tools/qstring.cpp
adf970c
@@ -5805,6 +5805,7 @@
adf970c
     result.setLength( len ); // worst case
adf970c
     QChar *qch = (QChar *)result.unicode();
adf970c
     uint uc = 0;
adf970c
+    uint min_uc = 0;
adf970c
     int need = 0;
adf970c
     int error = -1;
adf970c
     uchar ch;
adf970c
@@ -5822,6 +5823,12 @@
adf970c
 			unsigned short low = uc%0x400 + 0xdc00;
adf970c
 			*qch++ = QChar(high);
adf970c
 			*qch++ = QChar(low);
adf970c
+		    } else if (uc < min_uc || (uc >= 0xd800 && uc <= 0xdfff) || (uc >= 0xfffe)) {
adf970c
+			// overlong seqence, UTF16 surrogate or BOM
adf970c
+                        i = error;
adf970c
+                        qch = addOne(qch, result);
adf970c
+                        *qch++ = QChar(0xdbff);
adf970c
+                        *qch++ = QChar(0xde00+((uchar)utf8[i]));
adf970c
 		    } else {
adf970c
 			*qch++ = uc;
adf970c
 		    }
adf970c
@@ -5844,14 +5851,17 @@
adf970c
 		uc = ch & 0x1f;
adf970c
 		need = 1;
adf970c
 		error = i;
adf970c
+		min_uc = 0x80;
adf970c
 	    } else if ((ch & 0xf0) == 0xe0) {
adf970c
 		uc = ch & 0x0f;
adf970c
 		need = 2;
adf970c
 		error = i;
adf970c
+		min_uc = 0x800;
adf970c
 	    } else if ((ch&0xf8) == 0xf0) {
adf970c
 		uc = ch & 0x07;
adf970c
 		need = 3;
adf970c
 		error = i;
adf970c
+		min_uc = 0x10000;
adf970c
 	    } else {
adf970c
 	        // Error
adf970c
                 qch = addOne(qch, result);