D1218.diff
No OneTemporary
Actions

Size

1 KB

Referenced Files

None

Subscribers

None

D1218.diff
View Options

	Index: head/lib/libc/net/base64.c
	===================================================================
	--- head/lib/libc/net/base64.c
	+++ head/lib/libc/net/base64.c
	@@ -199,6 +199,7 @@
	size_t targsize;
	{
	int tarindex, state, ch;
	+ u_char nextbyte;
	char *pos;

	state = 0;
	@@ -226,22 +227,28 @@
	break;
	case 1:
	if (target) {
	- if ((size_t)tarindex + 1 >= targsize)
	+ if ((size_t)tarindex >= targsize)
	return (-1);
	target[tarindex] \|= (pos - Base64) >> 4;
	- target[tarindex+1] = ((pos - Base64) & 0x0f)
	- << 4 ;
	+ nextbyte = ((pos - Base64) & 0x0f) << 4;
	+ if ((size_t)tarindex + 1 < targsize)
	+ target[tarindex + 1] = nextbyte;
	+ else if (nextbyte)
	+ return (-1);
	}
	tarindex++;
	state = 2;
	break;
	case 2:
	if (target) {
	- if ((size_t)tarindex + 1 >= targsize)
	+ if ((size_t)tarindex >= targsize)
	return (-1);
	target[tarindex] \|= (pos - Base64) >> 2;
	- target[tarindex+1] = ((pos - Base64) & 0x03)
	- << 6;
	+ nextbyte = ((pos - Base64) & 0x03) << 6;
	+ if ((size_t)tarindex + 1 < targsize)
	+ target[tarindex + 1] = nextbyte;
	+ else if (nextbyte)
	+ return (-1);
	}
	tarindex++;
	state = 3;
	@@ -299,7 +306,8 @@
	* zeros. If we don't check them, they become a
	* subliminal channel.
	*/
	- if (target && target[tarindex] != 0)
	+ if (target && (size_t)tarindex < targsize &&
	+ target[tarindex] != 0)
	return (-1);
	}
	} else {