base64: fix out-of-bounds write in htp_base64_decode#461
base64: fix out-of-bounds write in htp_base64_decode#461zhangjy1014 wants to merge 1 commit intoOISF:0.5.xfrom
Conversation
|
Hi @catenacyber, please take a look |
|
Thanks for the work. |
|
Hi @catenacyber, thanks for your review, I've added several tests. The patched version passes all of them, while the unpatched version triggers an ASan error on each of them. |
| *plainchar++ |= (fragment & 0x030) >> 4; | ||
| *plainchar = (unsigned char) ((fragment & 0x00f) << 4); | ||
| if (--length_out == 0) { | ||
| decoder->step = step_c; |
There was a problem hiding this comment.
Why do we need this line ? It looks like the tests still pass without it...
|
Could you squash together all the commits ? |
…tput buffer (*plainchar) to store the partial result of the next byte before verifying if the output buffer had sufficient space. This resulted in a heap-buffer-overflow when the provided output buffer was undersized or exactly full. This patch fixes the issue by: Moving the partial byte assignment after the buffer length check. Correctly updating the decoder state (decoder->step and decoder->plainchar) when the buffer limit is reached, ensuring the state is preserved without writing out-of-bounds. Fixes OISF#458 This patch is generated by ASKRepair, an agentic automated vulnerability repair framework
zhangjy1014
force-pushed
the
fix-issue-458
branch
from
ffd2439 to
6cb45cb
Compare
squashed, thanks! |
|
Since this fixes an out-of-bounds write issue, could you help merge it when convenient? |
|
The commit message should be updated : the first line should be much shorter: like As for merging, I do not know, you can see I have #460 pending as well ;-) |
2 participants
The htp_base64_decode function previously performed a write to the output buffer (*plainchar) to store the partial result of the next byte before verifying if the output buffer had sufficient space. This resulted in a heap-buffer-overflow when the provided output buffer was undersized or exactly full.
This patch fixes the issue by:
Fixes #458
This patch is generated by ASKRepair, an agentic automated vulnerability repair framework