1*4882a593SmuzhiyunFix integer overflows. Will not work on compilers with unsigned char 2*4882a593Smuzhiyunas the default. 3*4882a593Smuzhiyun 4*4882a593SmuzhiyunFetched from: https://sources.debian.org/patches/libb64/1.2-5/ 5*4882a593Smuzhiyun 6*4882a593SmuzhiyunCombined "integer overflows.diff" and "off by one.diff" and adapted 7*4882a593Smuzhiyunfor version 1.2.1. 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunSigned-off-by: Mikael Eliasson <mikael@robomagi.com> 10*4882a593Smuzhiyun 11*4882a593Smuzhiyundiff --git a/src/cdecode.c b/src/cdecode.c 12*4882a593Smuzhiyunindex a6c0a42..45da4e1 100644 13*4882a593Smuzhiyun--- a/src/cdecode.c 14*4882a593Smuzhiyun+++ b/src/cdecode.c 15*4882a593Smuzhiyun@@ -9,10 +9,11 @@ For details, see http://sourceforge.net/projects/libb64 16*4882a593Smuzhiyun 17*4882a593Smuzhiyun int base64_decode_value(char value_in) 18*4882a593Smuzhiyun { 19*4882a593Smuzhiyun- static const char decoding[] = {62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-2,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51}; 20*4882a593Smuzhiyun+ static const signed char decoding[] = {62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-2,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51}; 21*4882a593Smuzhiyun static const char decoding_size = sizeof(decoding); 22*4882a593Smuzhiyun+ if (value_in < 43) return -1; 23*4882a593Smuzhiyun value_in -= 43; 24*4882a593Smuzhiyun- if (value_in < 0 || value_in >= decoding_size) return -1; 25*4882a593Smuzhiyun+ if (value_in >= decoding_size) return -1; 26*4882a593Smuzhiyun return decoding[(int)value_in]; 27*4882a593Smuzhiyun } 28*4882a593Smuzhiyun 29*4882a593Smuzhiyun@@ -26,7 +27,7 @@ int base64_decode_block(const char* code_in, const int length_in, char* plaintex 30*4882a593Smuzhiyun { 31*4882a593Smuzhiyun const char* codechar = code_in; 32*4882a593Smuzhiyun char* plainchar = plaintext_out; 33*4882a593Smuzhiyun- char fragment; 34*4882a593Smuzhiyun+ int fragment; 35*4882a593Smuzhiyun 36*4882a593Smuzhiyun *plainchar = state_in->plainchar; 37*4882a593Smuzhiyun 38*4882a593Smuzhiyun@@ -42,7 +43,7 @@ int base64_decode_block(const char* code_in, const int length_in, char* plaintex 39*4882a593Smuzhiyun state_in->plainchar = *plainchar; 40*4882a593Smuzhiyun return plainchar - plaintext_out; 41*4882a593Smuzhiyun } 42*4882a593Smuzhiyun- fragment = (char)base64_decode_value(*codechar++); 43*4882a593Smuzhiyun+ fragment = base64_decode_value(*codechar++); 44*4882a593Smuzhiyun } while (fragment < 0); 45*4882a593Smuzhiyun *plainchar = (fragment & 0x03f) << 2; 46*4882a593Smuzhiyun case step_b: 47*4882a593Smuzhiyun@@ -53,7 +54,7 @@ int base64_decode_block(const char* code_in, const int length_in, char* plaintex 48*4882a593Smuzhiyun state_in->plainchar = *plainchar; 49*4882a593Smuzhiyun return plainchar - plaintext_out; 50*4882a593Smuzhiyun } 51*4882a593Smuzhiyun- fragment = (char)base64_decode_value(*codechar++); 52*4882a593Smuzhiyun+ fragment = base64_decode_value(*codechar++); 53*4882a593Smuzhiyun } while (fragment < 0); 54*4882a593Smuzhiyun *plainchar++ |= (fragment & 0x030) >> 4; 55*4882a593Smuzhiyun *plainchar = (fragment & 0x00f) << 4; 56*4882a593Smuzhiyun@@ -65,7 +66,7 @@ int base64_decode_block(const char* code_in, const int length_in, char* plaintex 57*4882a593Smuzhiyun state_in->plainchar = *plainchar; 58*4882a593Smuzhiyun return plainchar - plaintext_out; 59*4882a593Smuzhiyun } 60*4882a593Smuzhiyun- fragment = (char)base64_decode_value(*codechar++); 61*4882a593Smuzhiyun+ fragment = base64_decode_value(*codechar++); 62*4882a593Smuzhiyun } while (fragment < 0); 63*4882a593Smuzhiyun *plainchar++ |= (fragment & 0x03c) >> 2; 64*4882a593Smuzhiyun *plainchar = (fragment & 0x003) << 6; 65*4882a593Smuzhiyun@@ -77,7 +78,7 @@ int base64_decode_block(const char* code_in, const int length_in, char* plaintex 66*4882a593Smuzhiyun state_in->plainchar = *plainchar; 67*4882a593Smuzhiyun return plainchar - plaintext_out; 68*4882a593Smuzhiyun } 69*4882a593Smuzhiyun- fragment = (char)base64_decode_value(*codechar++); 70*4882a593Smuzhiyun+ fragment = base64_decode_value(*codechar++); 71*4882a593Smuzhiyun } while (fragment < 0); 72*4882a593Smuzhiyun *plainchar++ |= (fragment & 0x03f); 73*4882a593Smuzhiyun } 74