SHS/pip
4
3
Fork 0
Code Issues 16 Pull Requests 2 Actions Releases Wiki Activity

fix(PIByteArray): prevent OOB in fromBase64 with non-multiple-of-4 input

Browse Source 
The buffer was sized as floor(sz/4)*3 but the loop ran ceil(sz/4)
times, writing 3 bytes per iteration. For sz%4!=0, this wrote past
the buffer end. Also guarded sz<4 to avoid processing trivially
short or malformed input.
This commit is contained in:
andrey
2026-08-06 10:19:13 +03:00
parent ec63e655d8
commit 8853d16826
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libs/main/types/pibytearray.cpp
+3 -2
View File
@@ -198,10 +198,11 @@ PIByteArray PIByteArray::fromBase64(const PIByteArray & base64) {
base64HelpStruct hs; base64HelpStruct hs;
PIByteArray ret; PIByteArray ret;
const int sz = base64.size_s(); const int sz = base64.size_s();
int ind = -1; if (sz < 4) return PIByteArray();
int ind = -1;
uchar t[4]; uchar t[4];
ret.resize(sz / 4 * 3); ret.resize(sz / 4 * 3);
for (int i = 0; i < sz; i += 4) { for (int i = 0; i < sz / 4 * 4; i += 4) {
hs.setAscii(base64.data(i)); hs.setAscii(base64.data(i));
hs.getBytes(t); hs.getBytes(t);
ret[++ind] = (t[0]); ret[++ind] = (t[0]);