summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--lib/libc/net/base64.c24
1 files changed, 16 insertions, 8 deletions
diff --git a/lib/libc/net/base64.c b/lib/libc/net/base64.c
index 78ef449a753..7c3d1d319f6 100644
--- a/lib/libc/net/base64.c
+++ b/lib/libc/net/base64.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: base64.c,v 1.6 2013/11/24 23:51:28 deraadt Exp $ */
+/* $OpenBSD: base64.c,v 1.7 2013/12/31 02:32:56 tedu Exp $ */
/*
* Copyright (c) 1996 by Internet Software Consortium.
@@ -194,6 +194,7 @@ b64_pton(src, target, targsize)
size_t targsize;
{
int tarindex, state, ch;
+ u_char nextbyte;
char *pos;
state = 0;
@@ -221,22 +222,28 @@ b64_pton(src, target, targsize)
break;
case 1:
if (target) {
- if (tarindex + 1 >= targsize)
+ if (tarindex >= targsize)
return (-1);
target[tarindex] |= (pos - Base64) >> 4;
- target[tarindex+1] = ((pos - Base64) & 0x0f)
- << 4 ;
+ nextbyte = ((pos - Base64) & 0x0f) << 4;
+ if (tarindex + 1 < targsize)
+ target[tarindex+1] = nextbyte;
+ else if (nextbyte)
+ return (-1);
}
tarindex++;
state = 2;
break;
case 2:
if (target) {
- if (tarindex + 1 >= targsize)
+ if (tarindex >= targsize)
return (-1);
target[tarindex] |= (pos - Base64) >> 2;
- target[tarindex+1] = ((pos - Base64) & 0x03)
- << 6;
+ nextbyte = ((pos - Base64) & 0x03) << 6;
+ if (tarindex + 1 < targsize)
+ target[tarindex+1] = nextbyte;
+ else if (nextbyte)
+ return (-1);
}
tarindex++;
state = 3;
@@ -292,7 +299,8 @@ b64_pton(src, target, targsize)
* zeros. If we don't check them, they become a
* subliminal channel.
*/
- if (target && target[tarindex] != 0)
+ if (target && tarindex < targsize &&
+ target[tarindex] != 0)
return (-1);
}
} else {