From 905ea76db4153b3e82eaac3c0291b4c7e4c597c5 Mon Sep 17 00:00:00 2001 From: Panu Matilainen Date: Wed, 14 Nov 2007 21:52:42 +0200 Subject: [PATCH] Fix base64 decoder related crash (rhbz#380911) The base64 decoder code incorrectly assumed that char is a signed type. Patch from Tomas Mraz --- rpmio/base64.c | 31 +++++++++++++++---------------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/rpmio/base64.c b/rpmio/base64.c index c9b6895..b11b381 100644 --- a/rpmio/base64.c +++ b/rpmio/base64.c @@ -98,21 +98,20 @@ char *b64encode(const void *data, size_t len, int linelen) return output; } -static int base64_decode_value(char value_in) +static int base64_decode_value(unsigned char value_in) { - static const char decoding[] = {62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-2,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51}; - static const char decoding_size = sizeof(decoding); + static const int decoding[] = {62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-2,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51}; value_in -= 43; - if (value_in < 0 || value_in > decoding_size) + if (value_in > sizeof(decoding)/sizeof(int)) return -1; - return decoding[(int)value_in]; + return decoding[value_in]; } static size_t base64_decode_block(const char *code_in, const size_t length_in, char *plaintext_out) { const char *codechar = code_in; char *plainchar = plaintext_out; - char fragment; + int fragment; *plainchar = 0; @@ -123,38 +122,38 @@ static size_t base64_decode_block(const char *code_in, const size_t length_in, c { return plainchar - plaintext_out; } - fragment = (char)base64_decode_value(*codechar++); + fragment = base64_decode_value(*codechar++); } while (fragment < 0); - *plainchar = (fragment & 0x03f) << 2; + *plainchar = (char)((fragment & 0x03f) << 2); do { if (codechar == code_in+length_in) { return plainchar - plaintext_out; } - fragment = (char)base64_decode_value(*codechar++); + fragment = base64_decode_value(*codechar++); } while (fragment < 0); - *plainchar++ |= (fragment & 0x030) >> 4; - *plainchar = (fragment & 0x00f) << 4; + *plainchar++ |= (char)((fragment & 0x030) >> 4); + *plainchar = (char)((fragment & 0x00f) << 4); do { if (codechar == code_in+length_in) { return plainchar - plaintext_out; } - fragment = (char)base64_decode_value(*codechar++); + fragment = base64_decode_value(*codechar++); } while (fragment < 0); - *plainchar++ |= (fragment & 0x03c) >> 2; - *plainchar = (fragment & 0x003) << 6; + *plainchar++ |= (char)((fragment & 0x03c) >> 2); + *plainchar = (char)((fragment & 0x003) << 6); do { if (codechar == code_in+length_in) { return plainchar - plaintext_out; } - fragment = (char)base64_decode_value(*codechar++); + fragment = base64_decode_value(*codechar++); } while (fragment < 0); - *plainchar++ |= (fragment & 0x03f); + *plainchar++ |= (char)(fragment & 0x03f); } /* control should not reach here */ return plainchar - plaintext_out; -- 2.7.4