Attachment #320742 for bug #430486

View | Details | Raw Unified | Return to bug 430486
Collapse All | Expand All

Lines 1-3 Link Here

(-)a/ChangeLog (+7 lines)
		1	2012-07-17
		2
		3	* src/b64.c: Use ceil instead of floor to compute the size
		4	of the data buffer. This prevents a one-byte heap buffer
		5	overflow. Thanks to Justin Ferguson <jnferguson@gmail.com>
		6	for the report.
		7
1	2008-06-15:	8	2008-06-15:
2		9
3	* README: Release version 3.2.0.	10	* README: Release version 3.2.0.

Lines 235-241 int otrl_base64_otr_decode(const char msg, unsigned char *bufp, Link Here

(-)a/src/b64.c (-1 / +1 lines)
235	}	235	}
236		236
237	/* Base64-decode the message */	237	/* Base64-decode the message */
238	rawlen = ((msglen-5) / 4) * 3; /* maximum possible */	238	rawlen = ((msglen-5+3) / 4) * 3; /* maximum possible */
239	rawmsg = malloc(rawlen);	239	rawmsg = malloc(rawlen);
240	if (!rawmsg && rawlen > 0) {	240	if (!rawmsg && rawlen > 0) {
241	return -1;	241	return -1;

Lines 1-3 Link Here

(-)a/ChangeLog (+5 lines)
		1	2012-07-19
		2
		3	* src/b64.[ch], src/proto.c: Clean up the previous b64 patch
		4	and apply it to all places where otrl_base64_decode() is called.
		5
1	2012-07-17	6	2012-07-17
2		7
3	* src/b64.c: Use ceil instead of floor to compute the size	8	* src/b64.c: Use ceil instead of floor to compute the size

Lines 55-61 VERSION HISTORY: Link Here

(-)a/src/b64.c (-5 / +11 lines)
55	\******************************************************************* */	55	\******************************************************************* */
56		56
57	/* system headers */	57	/* system headers */
58	#include <stdlib.h>	58	#include <stdio.h>
59	#include <string.h>	59	#include <string.h>
60		60
61	/* libotr headers */	61	/* libotr headers */
Lines 147-154 static size_t decode(unsigned char out, const char in, size_t b64len) Link Here
147	* base64 decode data. Skip non-base64 chars, and terminate at the	147	* base64 decode data. Skip non-base64 chars, and terminate at the
148	* first '=', or the end of the buffer.	148	* first '=', or the end of the buffer.
149	*	149	*
150	* The buffer data must contain at least (base64len / 4) * 3 bytes of	150	* The buffer data must contain at least ((base64len+3) / 4) * 3 bytes
151	* space. This function will return the number of bytes actually used.	151	* of space. This function will return the number of bytes actually
		152	* used.
152	*/	153	*/
153	size_t otrl_base64_decode(unsigned char data, const char base64data,	154	size_t otrl_base64_decode(unsigned char data, const char base64data,
154	size_t base64len)	155	size_t base64len)
Lines 234-246 int otrl_base64_otr_decode(const char msg, unsigned char *bufp, Link Here
234	return -2;	235	return -2;
235	}	236	}
236		237
		238	/* Skip over the "?OTR:" */
		239	otrtag += 5;
		240	msglen -= 5;
		241
237	/* Base64-decode the message */	242	/* Base64-decode the message */
238	rawlen = ((msglen-5+3) / 4) * 3; /* maximum possible */	243	rawlen = OTRL_B64_MAX_DECODED_SIZE(msglen); /* maximum possible */
239	rawmsg = malloc(rawlen);	244	rawmsg = malloc(rawlen);
240	if (!rawmsg && rawlen > 0) {	245	if (!rawmsg && rawlen > 0) {
241	return -1;	246	return -1;
242	}	247	}
243	rawlen = otrl_base64_decode(rawmsg, otrtag+5, msglen-5); /* actual size */	248
		249	rawlen = otrl_base64_decode(rawmsg, otrtag, msglen); /* actual size */
244		250
245	*bufp = rawmsg;	251	*bufp = rawmsg;
246	*lenp = rawlen;	252	*lenp = rawlen;




#ifndef __B64_H__
#define __B64_H__

#include <stdlib.h>

/* Base64 encodes blocks of this many bytes: */
#define OTRL_B64_DECODED_LEN 3
/* into blocks of this many bytes: */
#define OTRL_B64_ENCODED_LEN 4

/* An encoded block of length encoded_len can turn into a maximum of
 * this many decoded bytes: */
#define OTRL_B64_MAX_DECODED_SIZE(encoded_len) \
    (((encoded_len + OTRL_B64_ENCODED_LEN - 1) / OTRL_B64_ENCODED_LEN) \
	* OTRL_B64_DECODED_LEN)

/*
 * base64 encode data.  Insert no linebreaks or whitespace.
 *

 * base64 decode data.  Skip non-base64 chars, and terminate at the
 * first '=', or the end of the buffer.
 *
 * The buffer data must contain at least ((base64len+3) / 4) * 3 bytes
 * of space.  This function will return the number of bytes actually
 * used.
 */
size_t otrl_base64_decode(unsigned char *data, const char *base64data,
	size_t base64len);

Lines 537-549 gcry_error_t otrl_proto_data_read_flags(const char *datamsg, Link Here

(-)a/src/proto.c (-4 / +12 lines)
537	msglen = strlen(otrtag);	537	msglen = strlen(otrtag);
538	}	538	}
539		539
		540	/* Skip over the "?OTR:" */
		541	otrtag += 5;
		542	msglen -= 5;
		543
540	/* Base64-decode the message */	544	/* Base64-decode the message */
541	rawlen = ((msglen-5) / 4) * 3; /* maximum possible */	545	rawlen = OTRL_B64_MAX_DECODED_SIZE(msglen); /* maximum possible */
542	rawmsg = malloc(rawlen);	546	rawmsg = malloc(rawlen);
543	if (!rawmsg && rawlen > 0) {	547	if (!rawmsg && rawlen > 0) {
544	return gcry_error(GPG_ERR_ENOMEM);	548	return gcry_error(GPG_ERR_ENOMEM);
545	}	549	}
546	rawlen = otrl_base64_decode(rawmsg, otrtag+5, msglen-5); /* actual size */	550	rawlen = otrl_base64_decode(rawmsg, otrtag, msglen); /* actual size */
547		551
548	bufp = rawmsg;	552	bufp = rawmsg;
549	lenp = rawlen;	553	lenp = rawlen;
Lines 606-619 gcry_error_t otrl_proto_accept_data(char plaintextp, OtrlTLV tlvsp, Link Here
606	msglen = strlen(otrtag);	610	msglen = strlen(otrtag);
607	}	611	}
608		612
		613	/* Skip over the "?OTR:" */
		614	otrtag += 5;
		615	msglen -= 5;
		616
609	/* Base64-decode the message */	617	/* Base64-decode the message */
610	rawlen = ((msglen-5) / 4) * 3; /* maximum possible */	618	rawlen = OTRL_B64_MAX_DECODED_SIZE(msglen); /* maximum possible */
611	rawmsg = malloc(rawlen);	619	rawmsg = malloc(rawlen);
612	if (!rawmsg && rawlen > 0) {	620	if (!rawmsg && rawlen > 0) {
613	err = gcry_error(GPG_ERR_ENOMEM);	621	err = gcry_error(GPG_ERR_ENOMEM);
614	goto err;	622	goto err;
615	}	623	}
616	rawlen = otrl_base64_decode(rawmsg, otrtag+5, msglen-5); /* actual size */	624	rawlen = otrl_base64_decode(rawmsg, otrtag, msglen); /* actual size */
617		625
618	bufp = rawmsg;	626	bufp = rawmsg;
619	lenp = rawlen;	627	lenp = rawlen;

Lines 64-70 static unsigned char decode(const char msg, size_t *lenp) Link Here

(-)a/toolkit/parse.c (-3 / +6 lines)
64	{	64	{
65	const char header, footer;	65	const char header, footer;
66	unsigned char *raw;	66	unsigned char *raw;
67		67	size_t rawlen;
		68
68	/* Find the header */	69	/* Find the header */
69	header = strstr(msg, "?OTR:");	70	header = strstr(msg, "?OTR:");
70	if (!header) return NULL;	71	if (!header) return NULL;
Lines 75-82 static unsigned char decode(const char msg, size_t *lenp) Link Here
75	footer = strchr(header, '.');	76	footer = strchr(header, '.');
76	if (!footer) footer = header + strlen(header);	77	if (!footer) footer = header + strlen(header);
77		78
78	raw = malloc((footer-header) / 4 * 3);	79	rawlen = OTRL_B64_MAX_DECODED_SIZE(footer-header);
79	if (raw == NULL && (footer-header >= 4)) return NULL;	80
		81	raw = malloc(rawlen);
		82	if (raw == NULL && rawlen > 0) return NULL;
80	*lenp = otrl_base64_decode(raw, header, footer-header);	83	*lenp = otrl_base64_decode(raw, header, footer-header);
81		84
82	return raw;	85	return raw;

Return to bug 430486

Lines 20-25 Link Here

(-)a/src/b64.h (-2 / +16 lines)
20	#ifndef __B64_H__	20	#ifndef __B64_H__
21	#define __B64_H__	21	#define __B64_H__
22		22
		23	#include <stdlib.h>
		24
		25	/* Base64 encodes blocks of this many bytes: */
		26	#define OTRL_B64_DECODED_LEN 3
		27	/* into blocks of this many bytes: */
		28	#define OTRL_B64_ENCODED_LEN 4
		29
		30	/* An encoded block of length encoded_len can turn into a maximum of
		31	* this many decoded bytes: */
		32	#define OTRL_B64_MAX_DECODED_SIZE(encoded_len) \
		33	(((encoded_len + OTRL_B64_ENCODED_LEN - 1) / OTRL_B64_ENCODED_LEN) \
		34	* OTRL_B64_DECODED_LEN)
		35
23	/*	36	/*
24	* base64 encode data. Insert no linebreaks or whitespace.	37	* base64 encode data. Insert no linebreaks or whitespace.
25	*	38	*
Lines 33-40 size_t otrl_base64_encode(char base64data, const unsigned char data, Link Here
33	* base64 decode data. Skip non-base64 chars, and terminate at the	46	* base64 decode data. Skip non-base64 chars, and terminate at the
34	* first '=', or the end of the buffer.	47	* first '=', or the end of the buffer.
35	*	48	*
36	* The buffer data must contain at least (base64len / 4) * 3 bytes of	49	* The buffer data must contain at least ((base64len+3) / 4) * 3 bytes
37	* space. This function will return the number of bytes actually used.	50	* of space. This function will return the number of bytes actually
		51	* used.
38	*/	52	*/
39	size_t otrl_base64_decode(unsigned char data, const char base64data,	53	size_t otrl_base64_decode(unsigned char data, const char base64data,
40	size_t base64len);	54	size_t base64len);