From: Sergey Nikiforov <void@tarantool.org> To: tarantool-patches@dev.tarantool.org Cc: Vladislav Shpilevoy <v.shpilevoy@tarantool.org> Subject: [Tarantool-patches] [PATCH v5 1/2] base64: fix decoder output buffer overrun (reads) Date: Fri, 25 Dec 2020 13:41:04 +0300 [thread overview] Message-ID: <1b667fe9d32fd257f32a45d181f9ad3d1880a9b7.1608892639.git.void234@gmail.com> (raw) In-Reply-To: <cover.1608892639.git.void234@gmail.com> Was caught by base64 test with enabled ASAN. It also caused data corruption - garbage instead of "extra bits" was saved into state->result if there was no space in output buffer. Added test for "zero-sized output buffer" case. Fixes: #3069 --- test/unit/base64.c | 13 ++++++++++++- test/unit/base64.result | 3 ++- third_party/base64.c | 28 +++++++++++++++++----------- 3 files changed, 31 insertions(+), 13 deletions(-) diff --git a/test/unit/base64.c b/test/unit/base64.c index ada497adf..c0ccf1321 100644 --- a/test/unit/base64.c +++ b/test/unit/base64.c @@ -58,9 +58,18 @@ base64_nowrap_test(const char *str) base64_test(str, BASE64_NOWRAP, symbols, lengthof(symbols)); } +static void +base64_no_space_test(void) +{ + const char *const in = "sIIpHw=="; + const int in_len = strlen(in); + const int rc = base64_decode(in, in_len, NULL, 0); + is(rc, 0, "no space in out buffer"); +} + int main(int argc, char *argv[]) { - plan(28); + plan(29); header(); const char *option_tests[] = { @@ -78,6 +87,8 @@ int main(int argc, char *argv[]) base64_nowrap_test(option_tests[i]); } + base64_no_space_test(); + footer(); return check_plan(); } diff --git a/test/unit/base64.result b/test/unit/base64.result index cd1f2b3f6..71b3519bf 100644 --- a/test/unit/base64.result +++ b/test/unit/base64.result @@ -1,4 +1,4 @@ -1..28 +1..29 *** main *** 1..3 ok 1 - length @@ -175,4 +175,5 @@ ok 27 - subtests ok 3 - decode length ok ok 4 - encode/decode ok 28 - subtests +ok 29 - no space in out buffer *** main: done *** diff --git a/third_party/base64.c b/third_party/base64.c index 8ecab23eb..3350a98ff 100644 --- a/third_party/base64.c +++ b/third_party/base64.c @@ -247,8 +247,9 @@ base64_decode_block(const char *in_base64, int in_len, char *out_pos = out_bin; char *out_end = out_bin + out_len; int fragment; + char curr_byte; - *out_pos = state->result; + curr_byte = state->result; switch (state->step) { @@ -259,49 +260,54 @@ base64_decode_block(const char *in_base64, int in_len, if (in_pos == in_end || out_pos >= out_end) { state->step = step_a; - state->result = *out_pos; + state->result = curr_byte; return out_pos - out_bin; } fragment = base64_decode_value(*in_pos++); } while (fragment < 0); - *out_pos = (fragment & 0x03f) << 2; + curr_byte = (fragment & 0x03f) << 2; case step_b: do { if (in_pos == in_end || out_pos >= out_end) { state->step = step_b; - state->result = *out_pos; + state->result = curr_byte; return out_pos - out_bin; } fragment = base64_decode_value(*in_pos++); } while (fragment < 0); - *out_pos++ |= (fragment & 0x030) >> 4; + curr_byte |= (fragment & 0x030) >> 4; + *out_pos++ = curr_byte; + curr_byte = (fragment & 0x00f) << 4; if (out_pos < out_end) - *out_pos = (fragment & 0x00f) << 4; + *out_pos = curr_byte; case step_c: do { if (in_pos == in_end || out_pos >= out_end) { state->step = step_c; - state->result = *out_pos; + state->result = curr_byte; return out_pos - out_bin; } fragment = base64_decode_value(*in_pos++); } while (fragment < 0); - *out_pos++ |= (fragment & 0x03c) >> 2; + curr_byte |= (fragment & 0x03c) >> 2; + *out_pos++ = curr_byte; + curr_byte = (fragment & 0x003) << 6; if (out_pos < out_end) - *out_pos = (fragment & 0x003) << 6; + *out_pos = curr_byte; case step_d: do { if (in_pos == in_end || out_pos >= out_end) { state->step = step_d; - state->result = *out_pos; + state->result = curr_byte; return out_pos - out_bin; } fragment = base64_decode_value(*in_pos++); } while (fragment < 0); - *out_pos++ |= (fragment & 0x03f); + curr_byte |= (fragment & 0x03f); + *out_pos++ = curr_byte; } } /* control should not reach here */ -- 2.25.1
next prev parent reply other threads:[~2020-12-25 10:41 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-12-25 10:41 [Tarantool-patches] [PATCH v5 0/2] base64: Fix decoder, improve its performance Sergey Nikiforov 2020-12-25 10:41 ` Sergey Nikiforov [this message] 2020-12-25 13:00 ` [Tarantool-patches] [PATCH v5 1/2] base64: fix decoder output buffer overrun (reads) Leonid Vasiliev 2020-12-25 10:41 ` [Tarantool-patches] [PATCH v5 2/2] base64: improve decoder performance Sergey Nikiforov 2020-12-25 13:01 ` Leonid Vasiliev 2020-12-25 13:08 ` [Tarantool-patches] [PATCH v5 0/2] base64: Fix decoder, improve its performance Leonid Vasiliev 2020-12-25 14:09 Sergey Nikiforov 2020-12-25 14:09 ` [Tarantool-patches] [PATCH v5 1/2] base64: fix decoder output buffer overrun (reads) Sergey Nikiforov
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1b667fe9d32fd257f32a45d181f9ad3d1880a9b7.1608892639.git.void234@gmail.com \ --to=void@tarantool.org \ --cc=tarantool-patches@dev.tarantool.org \ --cc=v.shpilevoy@tarantool.org \ --subject='Re: [Tarantool-patches] [PATCH v5 1/2] base64: fix decoder output buffer overrun (reads)' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox