Fix base64d() buffer size (CVE-2018-6789)

[exim.git] / src / src / base64.c

diff --git a/src/src/base64.c b/src/src/base64.c
index f4c4f233b0105fd03547b44edd1cab07cae391a6..1d84c1e5c34116bbfdf9b137bd26ba19b1f3a1da 100644 (file)
--- a/src/src/base64.c
+++ b/src/src/base64.c
@@ -5,7 +5,7 @@
 /* Copyright (c) Tom Kistner <tom@duncanthrax.net> 2004, 2015 */
 /* License: GPL */
 
-/* Copyright (c) University of Cambridge 1995 - 2015 */
+/* Copyright (c) University of Cambridge 1995 - 2017 */
 /* See the file NOTICE for conditions of use and distribution. */
 
 
@@ -100,21 +100,21 @@ return size;
 #endif /*WITH_CONTENT_SCAN*/
 
 /*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
+ *************************************************
+ *************************************************
+ *************************************************
+ *************************************************
+ *************************************************
+ *************************************************
+ *************************************************
+ *************************************************
+ *************************************************
+ *************************************************
+ *************************************************
+ *************************************************
+ *************************************************
+ *************************************************
+ *************************************************/
 
 
 /*************************************************
@@ -129,11 +129,12 @@ compact loop is messy and would probably run more slowly.
 Arguments:
   code        points to the coded string, zero-terminated
   ptr         where to put the pointer to the result, which is in
-              dynamic store, and zero-terminated
+              allocated store, and zero-terminated
 
 Returns:      the number of bytes in the result,
               or -1 if the input was malformed
 
+Whitespace in the input is ignored.
 A zero is added on to the end to make it easy in cases where the result is to
 be interpreted as text. This is not included in the count. */
 
@@ -149,40 +150,67 @@ static uschar dec64table[] = {
 };
 
 int
-b64decode(uschar *code, uschar **ptr)
+b64decode(const uschar *code, uschar **ptr)
 {
+
 int x, y;
-uschar *result = store_get(3*(Ustrlen(code)/4) + 1);
+uschar *result;
 
-*ptr = result;
+{
+  int l = Ustrlen(code);
+  *ptr = result = store_get(1 + l/4 * 3 + l%4);
+}
 
 /* Each cycle of the loop handles a quantum of 4 input bytes. For the last
 quantum this may decode to 1, 2, or 3 output bytes. */
 
 while ((x = *code++) != 0)
   {
+  if (isspace(x)) continue;
+  /* debug_printf("b64d: '%c'\n", x); */
+
   if (x > 127 || (x = dec64table[x]) == 255) return -1;
-  if ((y = *code++) == 0 || (y = dec64table[y]) == 255)
+
+  while (isspace(y = *code++)) ;
+  /* debug_printf("b64d: '%c'\n", y); */
+  if (y == 0 || (y = dec64table[y]) == 255)
     return -1;
 
   *result++ = (x << 2) | (y >> 4);
+  /* debug_printf("b64d:      -> %02x\n", result[-1]); */
 
-  if ((x = *code++) == '=')
+  while (isspace(x = *code++)) ;
+  /* debug_printf("b64d: '%c'\n", x); */
+  if (x == '=')                /* endmarker, but there should be another */
     {
-    if (*code++ != '=' || *code != 0) return -1;
+    while (isspace(x = *code++)) ;
+    /* debug_printf("b64d: '%c'\n", x); */
+    if (x != '=') return -1;
+    while (isspace(y = *code++)) ;
+    if (y != 0) return -1;
+    /* debug_printf("b64d: DONE\n"); */
+    break;
     }
   else
     {
     if (x > 127 || (x = dec64table[x]) == 255) return -1;
     *result++ = (y << 4) | (x >> 2);
-    if ((y = (*code++)) == '=')
+    /* debug_printf("b64d:      -> %02x\n", result[-1]); */
+
+    while (isspace(y = *code++)) ;
+    /* debug_printf("b64d: '%c'\n", y); */
+    if (y == '=')
       {
-      if (*code != 0) return -1;
+      while (isspace(y = *code++)) ;
+      if (y != 0) return -1;
+      /* debug_printf("b64d: DONE\n"); */
+      break;
       }
     else
       {
       if (y > 127 || (y = dec64table[y]) == 255) return -1;
       *result++ = (x << 6) | y;
+      /* debug_printf("b64d:      -> %02x\n", result[-1]); */
       }
     }
   }
@@ -192,23 +220,6 @@ return result - *ptr;
 }
 
 
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-/*************************************************
-
 /*************************************************
 *          Encode byte-string in base 64         *
 *************************************************/
@@ -238,7 +249,7 @@ uschar *p = code;
 
 while (len-- >0)
   {
-  register int x, y;
+  int x, y;
 
   x = *clear++;
   *p++ = enc64table[(x >> 2) & 63];