1 files changed, 14 insertions, 12 deletions

diff --git a/src/coding.c b/src/coding.c
index 6dbf05ce0aa..e2a328fd908 100644
--- a/src/coding.c
+++ b/src/coding.c
@@ -3600,7 +3600,7 @@ decode_coding_iso_2022 (coding)
 
   while (1)
     {
-      int c1, c2;
+      int c1, c2, c3;
 
       src_base = src;
       consumed_chars_base = consumed_chars;
@@ -3984,26 +3984,28 @@ decode_coding_iso_2022 (coding)
         }
 
       /* Now we know CHARSET and 1st position code C1 of a character.
-         Produce a decoded character while getting 2nd position code
-         C2 if necessary.  */
-      c1 &= 0x7F;
+         Produce a decoded character while getting 2nd and 3rd
+         position codes C2, C3 if necessary.  */
       if (CHARSET_DIMENSION (charset) > 1)
         {
           ONE_MORE_BYTE (c2);
-          if (c2 < 0x20 || (c2 >= 0x80 && c2 < 0xA0))
+          if (c2 < 0x20 || (c2 >= 0x80 && c2 < 0xA0)
+              || ((c1 & 0x80) != (c2 & 0x80)))
             /* C2 is not in a valid range.  */
             goto invalid_code;
-          c1 = (c1 << 8) | (c2 & 0x7F);
-          if (CHARSET_DIMENSION (charset) > 2)
+          if (CHARSET_DIMENSION (charset) == 2)
+            c1 = (c1 << 8) | c2;
+          else
             {
-              ONE_MORE_BYTE (c2);
-              if (c2 < 0x20 || (c2 >= 0x80 && c2 < 0xA0))
-                /* C2 is not in a valid range.  */
+              ONE_MORE_BYTE (c3);
+              if (c3 < 0x20 || (c3 >= 0x80 && c3 < 0xA0)
+                  || ((c1 & 0x80) != (c3 & 0x80)))
+                /* C3 is not in a valid range.  */
                 goto invalid_code;
-              c1 = (c1 << 8) | (c2 & 0x7F);
+              c1 = (c1 << 16) | (c2 << 8) | c2;
             }
         }
-
+      c1 &= 0x7F7F7F;
       CODING_DECODE_CHAR (coding, src, src_base, src_end, charset, c1, c);
       if (c < 0)
         {