CVSROOT: /cvs
Module name: src
Changes by: js...@cvs.openbsd.org 2014/05/03 10:54:48
Modified files:
lib/libssl/src/crypto/evp: encode.c
Log message:
Add checks for invalid base64 encoded data, specifically relating to the
handling of padding. This fixes a crash that can be triggered by feeding
base64 data followed by 64 or more padding characters, which results in a
negative output length.
This issue was reported by David Ramos, although the same bug has been
sitting in the OpenSSL RT since 2011:
https://rt.openssl.org/Ticket/Display.html?id=2608
Worse still, BIO_read seems to be completely unable to detect that the
base64 input was invalid/corrupt - in particular, enabling
BIO_FLAGS_BASE64_NO_NL results in a stream of zero value bytes rather than
no input (possibly a good replacement for /dev/null...), which could
result in nasty consequences. Prior to this fix some zero value bytes were
also injected without this flag being enabled.
The recently added base64 regress triggers and documents these issues
(and also ensures that this change retains functional behaviour).
