yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-30 13:34:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix integer overflow in mbedtls_base64_decode()

Browse Source 
Fix potential integer overflows in the function mbedtls_base64_decode().
This overflow would mainly be exploitable in 32-bit systems and could
cause buffer bound checks to be bypassed.
This commit is contained in:
Andres AG 2017-01-18 17:21:03 +00:00 committed by Simon Butcher
parent cfad181250
commit 7ded99ff64
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog
View File

@ -15,6 +15,8 @@ Bugfix
cause buffer bound checks to be bypassed. Found by Eyal Itkin. cause buffer bound checks to be bypassed. Found by Eyal Itkin.
* Fixed potential arithmetic overflow in mbedtls_md2_update() that could * Fixed potential arithmetic overflow in mbedtls_md2_update() that could
cause buffer bound checks to be bypassed. Found by Eyal Itkin. cause buffer bound checks to be bypassed. Found by Eyal Itkin.
* Fixed potential arithmetic overflow in mbedtls_base64_decode() that could
cause buffer bound checks to be bypassed. Found by Eyal Itkin.
= mbed TLS 1.3.18 branch 2016-10-17 = mbed TLS 1.3.18 branch 2016-10-17

2
library/base64.c
View File

@ -198,7 +198,7 @@ int base64_decode( unsigned char *dst, size_t *dlen,
return( 0 ); return( 0 );
} }
n = ( ( n * 6 ) + 7 ) >> 3; n = ( 6 * ( n >> 3 ) ) + ( ( 6 * ( n & 0x7 ) + 7 ) >> 3 );
n -= j; n -= j;
if( dst == NULL || *dlen < n ) if( dst == NULL || *dlen < n )