From 3df7633eff8034a12d757357035500faa541b657 Mon Sep 17 00:00:00 2001 From: Dragan Dosen Date: Tue, 24 Aug 2021 09:48:04 +0200 Subject: [PATCH] BUG/MEDIUM: base64: check output boundaries within base64{dec,urldec} Ensure that no more than olen bytes is written to the output buffer, otherwise we might experience an unexpected behavior. While the original code used to validate that the output size was always large enough before starting to write, this validation was later broken by the commit below, allowing to 3-byte blocks to areas whose size is not multiple of 3: commit ed697e4856e5ac0b9931fd50fd8ff1b7739e5d88 Author: Emeric Brun Date: Mon Jan 14 14:38:39 2019 +0100 BUG/MINOR: base64: dec func ignores padding for output size checking Decode function returns an error even if the ouptut buffer is large enought because the padding was not considered. This case was never met with current code base. For base64urldec(), it's basically the same problem except that since the input format supports arbitrary lengths, the problem has always been there since its introduction in 2.4. This should be backported to all stable branches having a backport of the patch above (i.e. 2.0), with some adjustments depending on the availability of the base64dec() and base64urldec(). (cherry picked from commit f3899ddbcbf4c445d4a519fb04cc253e60d30e6e) Signed-off-by: Willy Tarreau (cherry picked from commit aec6e0244e8b1693c5f78bb5a0483986ef2ac688) [wt: dropped base64urldec] Signed-off-by: Willy Tarreau --- src/base64.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/base64.c b/src/base64.c index 53e4d65..e7b0982 100644 --- a/src/base64.c +++ b/src/base64.c @@ -122,9 +122,12 @@ int base64dec(const char *in, size_t ilen, char *out, size_t olen) { */ /* xx000000 xx001111 xx111122 xx222222 */ - out[convlen] = ((t[0] << 2) + (t[1] >> 4)); - out[convlen+1] = ((t[1] << 4) + (t[2] >> 2)); - out[convlen+2] = ((t[2] << 6) + (t[3] >> 0)); + if (convlen < olen) + out[convlen] = ((t[0] << 2) + (t[1] >> 4)); + if (convlen+1 < olen) + out[convlen+1] = ((t[1] << 4) + (t[2] >> 2)); + if (convlen+2 < olen) + out[convlen+2] = ((t[2] << 6) + (t[3] >> 0)); convlen += 3-pad; -- 1.7.10.4