Tarantool development patches archive
 help / color / mirror / Atom feed
From: Sergey Nikiforov <void@tarantool.org>
To: tarantool-patches@dev.tarantool.org
Cc: Vladislav Shpilevoy <v.shpilevoy@tarantool.org>
Subject: [Tarantool-patches] [PATCH v5 1/2] base64: fix decoder output buffer overrun (reads)
Date: Fri, 25 Dec 2020 13:41:04 +0300	[thread overview]
Message-ID: <1b667fe9d32fd257f32a45d181f9ad3d1880a9b7.1608892639.git.void234@gmail.com> (raw)
In-Reply-To: <cover.1608892639.git.void234@gmail.com>

Was caught by base64 test with enabled ASAN.

It also caused data corruption - garbage instead of "extra bits" was
saved into state->result if there was no space in output buffer.

Added test for "zero-sized output buffer" case.

Fixes: #3069
---
 test/unit/base64.c      | 13 ++++++++++++-
 test/unit/base64.result |  3 ++-
 third_party/base64.c    | 28 +++++++++++++++++-----------
 3 files changed, 31 insertions(+), 13 deletions(-)

diff --git a/test/unit/base64.c b/test/unit/base64.c
index ada497adf..c0ccf1321 100644
--- a/test/unit/base64.c
+++ b/test/unit/base64.c
@@ -58,9 +58,18 @@ base64_nowrap_test(const char *str)
 	base64_test(str, BASE64_NOWRAP, symbols, lengthof(symbols));
 }
 
+static void
+base64_no_space_test(void)
+{
+	const char *const in = "sIIpHw==";
+	const int in_len = strlen(in);
+	const int rc = base64_decode(in, in_len, NULL, 0);
+	is(rc, 0, "no space in out buffer");
+}
+
 int main(int argc, char *argv[])
 {
-	plan(28);
+	plan(29);
 	header();
 
 	const char *option_tests[] = {
@@ -78,6 +87,8 @@ int main(int argc, char *argv[])
 		base64_nowrap_test(option_tests[i]);
 	}
 
+	base64_no_space_test();
+
 	footer();
 	return check_plan();
 }
diff --git a/test/unit/base64.result b/test/unit/base64.result
index cd1f2b3f6..71b3519bf 100644
--- a/test/unit/base64.result
+++ b/test/unit/base64.result
@@ -1,4 +1,4 @@
-1..28
+1..29
 	*** main ***
     1..3
     ok 1 - length
@@ -175,4 +175,5 @@ ok 27 - subtests
     ok 3 - decode length ok
     ok 4 - encode/decode
 ok 28 - subtests
+ok 29 - no space in out buffer
 	*** main: done ***
diff --git a/third_party/base64.c b/third_party/base64.c
index 8ecab23eb..3350a98ff 100644
--- a/third_party/base64.c
+++ b/third_party/base64.c
@@ -247,8 +247,9 @@ base64_decode_block(const char *in_base64, int in_len,
 	char *out_pos = out_bin;
 	char *out_end = out_bin + out_len;
 	int fragment;
+	char curr_byte;
 
-	*out_pos = state->result;
+	curr_byte = state->result;
 
 	switch (state->step)
 	{
@@ -259,49 +260,54 @@ base64_decode_block(const char *in_base64, int in_len,
 				if (in_pos == in_end || out_pos >= out_end)
 				{
 					state->step = step_a;
-					state->result = *out_pos;
+					state->result = curr_byte;
 					return out_pos - out_bin;
 				}
 				fragment = base64_decode_value(*in_pos++);
 			} while (fragment < 0);
-			*out_pos    = (fragment & 0x03f) << 2;
+			curr_byte = (fragment & 0x03f) << 2;
 	case step_b:
 			do {
 				if (in_pos == in_end || out_pos >= out_end)
 				{
 					state->step = step_b;
-					state->result = *out_pos;
+					state->result = curr_byte;
 					return out_pos - out_bin;
 				}
 				fragment = base64_decode_value(*in_pos++);
 			} while (fragment < 0);
-			*out_pos++ |= (fragment & 0x030) >> 4;
+			curr_byte |= (fragment & 0x030) >> 4;
+			*out_pos++ = curr_byte;
+			curr_byte = (fragment & 0x00f) << 4;
 			if (out_pos < out_end)
-				*out_pos = (fragment & 0x00f) << 4;
+				*out_pos = curr_byte;
 	case step_c:
 			do {
 				if (in_pos == in_end || out_pos >= out_end)
 				{
 					state->step = step_c;
-					state->result = *out_pos;
+					state->result = curr_byte;
 					return out_pos - out_bin;
 				}
 				fragment = base64_decode_value(*in_pos++);
 			} while (fragment < 0);
-			*out_pos++ |= (fragment & 0x03c) >> 2;
+			curr_byte |= (fragment & 0x03c) >> 2;
+			*out_pos++ = curr_byte;
+			curr_byte = (fragment & 0x003) << 6;
 			if (out_pos < out_end)
-				*out_pos = (fragment & 0x003) << 6;
+				*out_pos = curr_byte;
 	case step_d:
 			do {
 				if (in_pos == in_end || out_pos >= out_end)
 				{
 					state->step = step_d;
-					state->result = *out_pos;
+					state->result = curr_byte;
 					return out_pos - out_bin;
 				}
 				fragment = base64_decode_value(*in_pos++);
 			} while (fragment < 0);
-			*out_pos++   |= (fragment & 0x03f);
+			curr_byte |= (fragment & 0x03f);
+			*out_pos++ = curr_byte;
 		}
 	}
 	/* control should not reach here */
-- 
2.25.1

  reply	other threads:[~2020-12-25 10:41 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-12-25 10:41 [Tarantool-patches] [PATCH v5 0/2] base64: Fix decoder, improve its performance Sergey Nikiforov
2020-12-25 10:41 ` Sergey Nikiforov [this message]
2020-12-25 13:00   ` [Tarantool-patches] [PATCH v5 1/2] base64: fix decoder output buffer overrun (reads) Leonid Vasiliev
2020-12-25 10:41 ` [Tarantool-patches] [PATCH v5 2/2] base64: improve decoder performance Sergey Nikiforov
2020-12-25 13:01   ` Leonid Vasiliev
2020-12-25 13:08 ` [Tarantool-patches] [PATCH v5 0/2] base64: Fix decoder, improve its performance Leonid Vasiliev
2020-12-25 14:09 Sergey Nikiforov
2020-12-25 14:09 ` [Tarantool-patches] [PATCH v5 1/2] base64: fix decoder output buffer overrun (reads) Sergey Nikiforov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1b667fe9d32fd257f32a45d181f9ad3d1880a9b7.1608892639.git.void234@gmail.com \
    --to=void@tarantool.org \
    --cc=tarantool-patches@dev.tarantool.org \
    --cc=v.shpilevoy@tarantool.org \
    --subject='Re: [Tarantool-patches] [PATCH v5 1/2] base64: fix decoder output buffer overrun (reads)' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox