moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-12-22 08:08:50 -05:00
Code Issues Releases Wiki Activity

Fix for a base64 decode heap buffer overflow vulnerability.

Browse Source
This commit is contained in:
Dan Fandrich 2005-02-28 23:54:17 +00:00
parent 9798432f56
commit 0ddab51ad8
1 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
lib/base64.c
View File

@ -93,24 +93,38 @@ size_t Curl_base64_decode(const char *src, unsigned char **outptr)
while((src[length] != '=') && src[length]) while((src[length] != '=') && src[length])
length++; length++;
while(src[length+equalsTerm] == '=') /* A maximum of two = padding characters is allowed */
if(src[length] == '=') {
equalsTerm++; equalsTerm++;
if(src[length+equalsTerm] == '=')
equalsTerm++;
}
numQuantums = (length + equalsTerm) / 4; numQuantums = (length + equalsTerm) / 4;
/* Don't allocate a buffer if the decoded length is 0 */
if (numQuantums <= 0)
return 0;
rawlen = (numQuantums * 3) - equalsTerm; rawlen = (numQuantums * 3) - equalsTerm;
newstr = malloc(rawlen+1); /* The buffer must be large enough to make room for the last quantum
(which may be partially thrown out) and the zero terminator. */
newstr = malloc(rawlen+4);
if(!newstr) if(!newstr)
return 0; return 0;
*outptr = newstr; *outptr = newstr;
/* Decode all but the last quantum (which may not decode to a
multiple of 3 bytes) */
for(i = 0; i < numQuantums - 1; i++) { for(i = 0; i < numQuantums - 1; i++) {
decodeQuantum((unsigned char *)newstr, src); decodeQuantum((unsigned char *)newstr, src);
newstr += 3; src += 4; newstr += 3; src += 4;
} }
/* This final decode may actually read slightly past the end of the buffer
if the input string is missing pad bytes. This will almost always be
harmless. */
decodeQuantum(lastQuantum, src); decodeQuantum(lastQuantum, src);
for(i = 0; i < 3 - equalsTerm; i++) for(i = 0; i < 3 - equalsTerm; i++)
newstr[i] = lastQuantum[i]; newstr[i] = lastQuantum[i];