Fix base64d() buffer size (CVE-2018-6789)

Credits for discovering this bug: Meh Chang <meh@devco.re>

(cherry picked from commit 062990cc1b2f9e5d82a413b53c8f0569075de700)

diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 1ee00168f93ca4a0f74c4523071956becf8700fa..8ae418ab1f7cc2ab8f04a5471eea225c272248db 100644 (file)
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -5,8 +5,8 @@ affect Exim's operation, with an unchanged configuration file.  For new
 options, and new features, see the NewStuff file next to this ChangeLog.
 
 
 options, and new features, see the NewStuff file next to this ChangeLog.
 
 

-Exim version 4.91
------------------
+Since Exim version 4.90
+-----------------------

 
 JH/01 Replace the store_release() internal interface with store_newblock(),
       which internalises the check required to safely use the old one, plus
 
 JH/01 Replace the store_release() internal interface with store_newblock(),
       which internalises the check required to safely use the old one, plus


@@ -82,6 +82,8 @@ JH/15 Relax results from ACL control request to enable cutthrough, in
       ignoring.  This covers use with PRDR, frozen messages, queue-only and
       fake-reject.
 
       ignoring.  This covers use with PRDR, frozen messages, queue-only and
       fake-reject.
 

+HS/01 Fix Buffer overflow in base64d() (CVE-2018-6789)
+

 JH/16 Fix bug in DKIM verify: a buffer overflow could corrupt the malloc
       metadata, resulting in a crash in free().
 
 JH/16 Fix bug in DKIM verify: a buffer overflow could corrupt the malloc
       metadata, resulting in a crash in free().
 

diff --git a/src/src/base64.c b/src/src/base64.c
index ae6874b8a8b255335116fd81ef4746d5c40ffdbe..1d84c1e5c34116bbfdf9b137bd26ba19b1f3a1da 100644 (file)
--- a/src/src/base64.c
+++ b/src/src/base64.c
@@ -152,10 +152,14 @@ static uschar dec64table[] = {
 int
 b64decode(const uschar *code, uschar **ptr)
 {
 int
 b64decode(const uschar *code, uschar **ptr)
 {

+

 int x, y;
 int x, y;

-uschar *result = store_get(3*(Ustrlen(code)/4) + 1);
+uschar *result;

 
 

-*ptr = result;
+{
+  int l = Ustrlen(code);
+  *ptr = result = store_get(1 + l/4 * 3 + l%4);
+}

 
 /* Each cycle of the loop handles a quantum of 4 input bytes. For the last
 quantum this may decode to 1, 2, or 3 output bytes. */
 
 /* Each cycle of the loop handles a quantum of 4 input bytes. For the last
 quantum this may decode to 1, 2, or 3 output bytes. */