1 Star 0 Fork 25

Jason011125/apr

forked from src-openEuler/apr 
加入 Gitee
与超过 1200万 开发者一起发现、参与优秀开源项目,私有仓库也完全免费 :)
免费加入
文件
该仓库未声明开源许可证文件(LICENSE),使用请关注具体项目描述及其代码上游依赖。
克隆/下载
backport-apr_decode_base-64-32-16-stop-reading-before-not-inc.patch 7.02 KB
一键复制 编辑 原始数据 按行查看 历史
fly_fzc 提交于 2023-02-13 11:33 +08:00 . Fix CVE-2022-24963
From e70d77ecc4aa9e0dccac6e7e5ba74639f71f50cf Mon Sep 17 00:00:00 2001
From: Yann Ylavic <ylavic@apache.org>
Date: Fri, 27 Nov 2020 17:04:06 +0000
Subject: [PATCH] apr_decode_base{64,32,16}: stop reading before (not
including) NUL byte.
git-svn-id: https://svn.apache.org/repos/asf/apr/apr/trunk@1883870 13f79535-47bb-0310-9956-ffa450edef68
---
encoding/apr_encode.c | 60 ++++++++++++++++++++++++++++++-------------
test/testencode.c | 24 ++++++++++++-----
2 files changed, 59 insertions(+), 25 deletions(-)
diff --git a/encoding/apr_encode.c b/encoding/apr_encode.c
index b3278c7fd..bc2dc5437 100644
--- a/encoding/apr_encode.c
+++ b/encoding/apr_encode.c
@@ -394,11 +394,15 @@ APR_DECLARE(apr_status_t) apr_decode_base64(char *dest, const char *src,
apr_status_t status;
bufin = (const unsigned char *)src;
- while (pr2six[*(bufin++)] < 64 && count)
+ while (count && pr2six[*bufin] < 64) {
count--;
- nprbytes = (bufin - (const unsigned char *)src) - 1;
- while (pr2six[*(bufin++)] > 64 && count)
+ bufin++;
+ }
+ nprbytes = bufin - (const unsigned char *)src;
+ while (count && pr2six[*bufin] > 64) {
count--;
+ bufin++;
+ }
status = flags & APR_ENCODE_RELAXED ? APR_SUCCESS :
count ? APR_BADCH : APR_SUCCESS;
@@ -469,11 +473,15 @@ APR_DECLARE(apr_status_t) apr_decode_base64_binary(unsigned char *dest,
apr_status_t status;
bufin = (const unsigned char *)src;
- while (pr2six[*(bufin++)] < 64 && count)
+ while (count && pr2six[*bufin] < 64) {
count--;
- nprbytes = (bufin - (const unsigned char *)src) - 1;
- while (pr2six[*(bufin++)] > 64 && count)
+ bufin++;
+ }
+ nprbytes = bufin - (const unsigned char *)src;
+ while (count && pr2six[*bufin] > 64) {
count--;
+ bufin++;
+ }
status = flags & APR_ENCODE_RELAXED ? APR_SUCCESS :
count ? APR_BADCH : APR_SUCCESS;
@@ -842,11 +850,15 @@ APR_DECLARE(apr_status_t) apr_decode_base32(char *dest, const char *src,
}
bufin = (const unsigned char *)src;
- while (pr2[*(bufin++)] < 32 && count)
+ while (count && pr2[*bufin] < 32) {
count--;
- nprbytes = (bufin - (const unsigned char *)src) - 1;
- while (pr2[*(bufin++)] > 32 && count)
+ bufin++;
+ }
+ nprbytes = bufin - (const unsigned char *)src;
+ while (count && pr2[*bufin] > 32) {
count--;
+ bufin++;
+ }
status = flags & APR_ENCODE_RELAXED ? APR_SUCCESS :
count ? APR_BADCH : APR_SUCCESS;
@@ -945,11 +957,15 @@ APR_DECLARE(apr_status_t) apr_decode_base32_binary(unsigned char *dest,
}
bufin = (const unsigned char *)src;
- while (pr2[*(bufin++)] < 32 && count)
+ while (count && pr2[*bufin] < 32) {
count--;
- nprbytes = (bufin - (const unsigned char *)src) - 1;
- while (pr2[*(bufin++)] > 32 && count)
+ bufin++;
+ }
+ nprbytes = bufin - (const unsigned char *)src;
+ while (count && pr2[*bufin] > 32) {
count--;
+ bufin++;
+ }
status = flags & APR_ENCODE_RELAXED ? APR_SUCCESS :
count ? APR_BADCH : APR_SUCCESS;
@@ -1220,11 +1236,15 @@ APR_DECLARE(apr_status_t) apr_decode_base16(char *dest,
count = slen;
bufin = (const unsigned char *)src;
- while (pr2two[*(bufin++)] != 16 && count)
+ while (count && pr2two[*bufin] != 16) {
count--;
- nprbytes = (bufin - (const unsigned char *)src) - 1;
- while (pr2two[*(bufin++)] > 16 && count)
+ bufin++;
+ }
+ nprbytes = bufin - (const unsigned char *)src;
+ while (count && pr2two[*bufin] > 16) {
count--;
+ bufin++;
+ }
status = flags & APR_ENCODE_RELAXED ? APR_SUCCESS :
count ? APR_BADCH : APR_SUCCESS;
@@ -1310,11 +1330,15 @@ APR_DECLARE(apr_status_t) apr_decode_base16_binary(unsigned char *dest,
count = slen;
bufin = (const unsigned char *)src;
- while (pr2two[*(bufin++)] != 16 && count)
+ while (count && pr2two[*bufin] != 16) {
count--;
- nprbytes = (bufin - (const unsigned char *)src) - 1;
- while (pr2two[*(bufin++)] > 16 && count)
+ bufin++;
+ }
+ nprbytes = bufin - (const unsigned char *)src;
+ while (count && pr2two[*bufin] > 16) {
count--;
+ bufin++;
+ }
status = flags & APR_ENCODE_RELAXED ? APR_SUCCESS :
count ? APR_BADCH : APR_SUCCESS;
diff --git a/test/testencode.c b/test/testencode.c
index 3680fa380..ba23aaf28 100644
--- a/test/testencode.c
+++ b/test/testencode.c
@@ -134,37 +134,42 @@ static void test_decode_base64(abts_case * tc, void *data)
src = "";
target = "";
dest = apr_pdecode_base64(pool, src, APR_ENCODE_STRING, APR_ENCODE_NONE, &len);
- ABTS_STR_EQUAL(tc, dest, target);
+ ABTS_STR_EQUAL(tc, target, dest);
src = "Zg==";
target = "f";
dest = apr_pdecode_base64(pool, src, APR_ENCODE_STRING, APR_ENCODE_NONE, &len);
- ABTS_STR_EQUAL(tc, dest, target);
+ ABTS_STR_EQUAL(tc, target, dest);
+
+ src = "Zg=";
+ target = "f";
+ dest = apr_pdecode_base64(pool, src, APR_ENCODE_STRING, APR_ENCODE_NONE, &len);
+ ABTS_STR_EQUAL(tc, target, dest);
src = "Zg";
target = "f";
dest = apr_pdecode_base64(pool, src, APR_ENCODE_STRING, APR_ENCODE_NONE, &len);
- ABTS_STR_EQUAL(tc, dest, target);
+ ABTS_STR_EQUAL(tc, target, dest);
src = "Zm8=";
target = "fo";
dest = apr_pdecode_base64(pool, src, APR_ENCODE_STRING, APR_ENCODE_NONE, &len);
- ABTS_STR_EQUAL(tc, dest, target);
+ ABTS_STR_EQUAL(tc, target, dest);
src = "Zm8";
target = "fo";
dest = apr_pdecode_base64(pool, src, APR_ENCODE_STRING, APR_ENCODE_NONE, &len);
- ABTS_STR_EQUAL(tc, dest, target);
+ ABTS_STR_EQUAL(tc, target, dest);
src = "Zm9v";
target = "foo";
dest = apr_pdecode_base64(pool, src, APR_ENCODE_STRING, APR_ENCODE_NONE, &len);
- ABTS_STR_EQUAL(tc, dest, target);
+ ABTS_STR_EQUAL(tc, target, dest);
src = "Zm9v";
target = "foo";
dest = apr_pdecode_base64(pool, src, APR_ENCODE_STRING, APR_ENCODE_NONE, &len);
- ABTS_STR_EQUAL(tc, dest, target);
+ ABTS_STR_EQUAL(tc, target, dest);
apr_pool_destroy(pool);
}
@@ -191,6 +196,11 @@ static void test_decode_base64_binary(abts_case * tc, void *data)
ABTS_ASSERT(tc, "apr_pdecode_base64_binary target!=dest", memcmp(ufoobar, udest, 1) == 0);
ABTS_INT_EQUAL(tc, len, 1);
+ src = "Zg=";
+ udest = apr_pdecode_base64_binary(pool, src, APR_ENCODE_STRING, APR_ENCODE_NONE, &len);
+ ABTS_ASSERT(tc, "apr_pdecode_base64_binary target!=dest", memcmp(ufoobar, udest, 1) == 0);
+ ABTS_INT_EQUAL(tc, len, 1);
+
src = "Zg";
udest = apr_pdecode_base64_binary(pool, src, APR_ENCODE_STRING, APR_ENCODE_NONE, &len);
ABTS_ASSERT(tc, "apr_pdecode_base64_binary target!=dest", memcmp(ufoobar, udest, 1) == 0);
--
2.27.0
Loading...
马建仓 AI 助手
尝试更多
代码解读
代码找茬
代码优化
1
https://gitee.com/Jason_828e/apr.git
git@gitee.com:Jason_828e/apr.git
Jason_828e
apr
apr
master

搜索帮助