From: Sergey Nikiforov via Tarantool-patches <tarantool-patches@dev.tarantool.org> To: tarantool-patches@dev.tarantool.org Cc: Vladislav Shpilevoy <v.shpilevoy@tarantool.org>, Alexander Turenko <alexander.turenko@tarantool.org> Subject: [Tarantool-patches] [PATCH v6 1/2] base64: fix decoder output buffer overrun (reads) Date: Mon, 11 Jan 2021 12:45:00 +0300 [thread overview] Message-ID: <7f5ce3321cda6d4305282af486ed2f493b920d1f.1610357625.git.void@tarantool.org> (raw) In-Reply-To: <cover.1610357625.git.void@tarantool.org> Was caught by base64 test with enabled ASAN. It also caused data corruption - garbage instead of "extra bits" was saved into state->result if there was no space in output buffer. Added test for "zero-sized output buffer" case. Fixes: #3069 --- Branch: https://github.com/tarantool/tarantool/tree/void234/gh-3069-fix-base64-memory-overrun-v6 Issue: https://github.com/tarantool/tarantool/issues/3069 test/unit/base64.c | 16 +++++++++++++++- test/unit/base64.result | 5 ++++- third_party/base64.c | 28 +++++++++++++++++----------- 3 files changed, 36 insertions(+), 13 deletions(-) diff --git a/test/unit/base64.c b/test/unit/base64.c index cc74f64d1..508877217 100644 --- a/test/unit/base64.c +++ b/test/unit/base64.c @@ -75,9 +75,22 @@ base64_invalid_chars_test(void) check_plan(); } +static void +base64_no_space_test(void) +{ + plan(1); + + const char *const in = "sIIpHw=="; + const int in_len = strlen(in); + const int rc = base64_decode(in, in_len, NULL, 0); + is(rc, 0, "no space in out buffer"); + + check_plan(); +} + int main(int argc, char *argv[]) { - plan(29); + plan(30); header(); const char *option_tests[] = { @@ -96,6 +109,7 @@ int main(int argc, char *argv[]) } base64_invalid_chars_test(); + base64_no_space_test(); footer(); return check_plan(); diff --git a/test/unit/base64.result b/test/unit/base64.result index 3bc2c2275..495e2d0a2 100644 --- a/test/unit/base64.result +++ b/test/unit/base64.result @@ -1,4 +1,4 @@ -1..29 +1..30 *** main *** 1..3 ok 1 - length @@ -178,4 +178,7 @@ ok 28 - subtests 1..1 ok 1 - ignoring invalid chars ok 29 - subtests + 1..1 + ok 1 - no space in out buffer +ok 30 - subtests *** main: done *** diff --git a/third_party/base64.c b/third_party/base64.c index 7c69315ea..3ecd0843a 100644 --- a/third_party/base64.c +++ b/third_party/base64.c @@ -248,8 +248,9 @@ base64_decode_block(const char *in_base64, int in_len, char *out_pos = out_bin; char *out_end = out_bin + out_len; int fragment; + char curr_byte; - *out_pos = state->result; + curr_byte = state->result; switch (state->step) { @@ -260,49 +261,54 @@ base64_decode_block(const char *in_base64, int in_len, if (in_pos == in_end || out_pos >= out_end) { state->step = step_a; - state->result = *out_pos; + state->result = curr_byte; return out_pos - out_bin; } fragment = base64_decode_value(*in_pos++); } while (fragment < 0); - *out_pos = (fragment & 0x03f) << 2; + curr_byte = (fragment & 0x03f) << 2; case step_b: do { if (in_pos == in_end || out_pos >= out_end) { state->step = step_b; - state->result = *out_pos; + state->result = curr_byte; return out_pos - out_bin; } fragment = base64_decode_value(*in_pos++); } while (fragment < 0); - *out_pos++ |= (fragment & 0x030) >> 4; + curr_byte |= (fragment & 0x030) >> 4; + *out_pos++ = curr_byte; + curr_byte = (fragment & 0x00f) << 4; if (out_pos < out_end) - *out_pos = (fragment & 0x00f) << 4; + *out_pos = curr_byte; case step_c: do { if (in_pos == in_end || out_pos >= out_end) { state->step = step_c; - state->result = *out_pos; + state->result = curr_byte; return out_pos - out_bin; } fragment = base64_decode_value(*in_pos++); } while (fragment < 0); - *out_pos++ |= (fragment & 0x03c) >> 2; + curr_byte |= (fragment & 0x03c) >> 2; + *out_pos++ = curr_byte; + curr_byte = (fragment & 0x003) << 6; if (out_pos < out_end) - *out_pos = (fragment & 0x003) << 6; + *out_pos = curr_byte; case step_d: do { if (in_pos == in_end || out_pos >= out_end) { state->step = step_d; - state->result = *out_pos; + state->result = curr_byte; return out_pos - out_bin; } fragment = base64_decode_value(*in_pos++); } while (fragment < 0); - *out_pos++ |= (fragment & 0x03f); + curr_byte |= (fragment & 0x03f); + *out_pos++ = curr_byte; } } /* control should not reach here */ -- 2.25.1
next prev parent reply other threads:[~2021-01-11 9:45 UTC|newest] Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-01-11 9:44 [Tarantool-patches] [PATCH v6 0/2] base64: Fix decoder, improve its performance Sergey Nikiforov via Tarantool-patches 2021-01-11 9:45 ` Sergey Nikiforov via Tarantool-patches [this message] 2021-01-21 2:16 ` [Tarantool-patches] [PATCH v6 1/2] base64: fix decoder output buffer overrun (reads) Alexander Turenko via Tarantool-patches 2021-01-26 16:37 ` Sergey Nikiforov via Tarantool-patches 2021-01-26 16:48 ` Sergey Nikiforov via Tarantool-patches 2021-02-20 11:30 ` Alexander Turenko via Tarantool-patches 2021-02-20 12:49 ` Alexander Turenko via Tarantool-patches 2021-02-25 8:25 ` Sergey Nikiforov via Tarantool-patches 2021-02-27 18:47 ` Alexander Turenko via Tarantool-patches 2021-01-11 9:45 ` [Tarantool-patches] [PATCH v6 2/2] base64: improve decoder performance Sergey Nikiforov via Tarantool-patches 2021-01-21 15:31 ` Alexander Turenko via Tarantool-patches 2021-01-26 16:37 ` Sergey Nikiforov via Tarantool-patches 2021-02-20 12:51 ` Alexander Turenko via Tarantool-patches 2021-01-12 19:39 ` [Tarantool-patches] [PATCH v6 0/2] base64: Fix decoder, improve its performance Alexander Turenko via Tarantool-patches
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=7f5ce3321cda6d4305282af486ed2f493b920d1f.1610357625.git.void@tarantool.org \ --to=tarantool-patches@dev.tarantool.org \ --cc=alexander.turenko@tarantool.org \ --cc=v.shpilevoy@tarantool.org \ --cc=void@tarantool.org \ --subject='Re: [Tarantool-patches] [PATCH v6 1/2] base64: fix decoder output buffer overrun (reads)' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox