fix(PIByteArray): prevent OOB in fromBase64 with non-multiple-of-4 input
The buffer was sized as floor(sz/4)*3 but the loop ran ceil(sz/4) times, writing 3 bytes per iteration. For sz%4!=0, this wrote past the buffer end. Also guarded sz<4 to avoid processing trivially short or malformed input.
This commit is contained in:
@@ -198,10 +198,11 @@ PIByteArray PIByteArray::fromBase64(const PIByteArray & base64) {
|
||||
base64HelpStruct hs;
|
||||
PIByteArray ret;
|
||||
const int sz = base64.size_s();
|
||||
if (sz < 4) return PIByteArray();
|
||||
int ind = -1;
|
||||
uchar t[4];
|
||||
ret.resize(sz / 4 * 3);
|
||||
for (int i = 0; i < sz; i += 4) {
|
||||
for (int i = 0; i < sz / 4 * 4; i += 4) {
|
||||
hs.setAscii(base64.data(i));
|
||||
hs.getBytes(t);
|
||||
ret[++ind] = (t[0]);
|
||||
|
||||
Reference in New Issue
Block a user