yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2025-01-05 14:35:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix potential overflow in base64_encode

Browse source
This commit is contained in:
Manuel Pégourié-Gonnard 2015-09-30 16:30:28 +02:00
parent b73ce45b3f
commit e4e4be77be
3 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ChangeLog
View file

@ -15,6 +15,9 @@ Security
on crafted PEM input data. Found an fix provided by Guid Vranken.
Not triggerable remotely in TLS. Triggerable remotely if you accept PEM
data from an untrusted source.
* Fix possible heap buffer overflow in base64_encode() when the input
buffer is 512MB or larger on 32-bit platforms.
Found by Guido Vranken. Not trigerrable remotely in TLS.
= Version 1.2.16 released 2015-09-17

3
include/polarssl/base64.h
View file

@ -25,6 +25,7 @@
#define POLARSSL_BASE64_H
#include <string.h>
#include <limits.h>
#define POLARSSL_ERR_BASE64_BUFFER_TOO_SMALL -0x002A /**< Output buffer too small. */
#define POLARSSL_ERR_BASE64_INVALID_CHARACTER -0x002C /**< Invalid character in input. */
@ -44,6 +45,8 @@ extern "C" {
* \return 0 if successful, or POLARSSL_ERR_BASE64_BUFFER_TOO_SMALL.
* *dlen is always updated to reflect the amount
* of data that has (or would have) been written.
* If that length cannot be represented, then no data is
* written to the buffer and *dlen is set to SIZE_T_MAX.
*
* \note Call this function with *dlen = 0 to obtain the
* required buffer size in *dlen

11
library/base64.c
View file

@ -77,15 +77,16 @@ int base64_encode( unsigned char *dst, size_t *dlen,
return( 0 );
}
n = (slen << 3) / 6;
n = slen / 3 + ( slen % 3 != 0 );
switch( (slen << 3) - (n * 6) )
if( n > ( SIZE_T_MAX - 1 ) / 4 )
{
case 2: n += 3; break;
case 4: n += 2; break;
default: break;
*dlen = SIZE_T_MAX;
return( POLARSSL_ERR_BASE64_BUFFER_TOO_SMALL );
}
n *= 4;
if( *dlen < n + 1 )
{
*dlen = n + 1;