Fix Non CF access to table in base64 decrypt
Signed-off-by: Paul Elliott <paul.elliott@arm.com>
diff --git a/library/base64.c b/library/base64.c
index 1c16a88..ce95918 100644
--- a/library/base64.c
+++ b/library/base64.c
@@ -66,9 +66,9 @@
#define BASE64_SIZE_T_MAX ( (size_t) -1 ) /* SIZE_T_MAX is not standard */
/*
- * Constant flow conditional assignment
+ * Constant flow conditional assignment to unsigned char
*/
-static void mbedtls_base64_cond_assign(unsigned char * dest, const unsigned char * const src,
+static void mbedtls_base64_cond_assign_uchar(unsigned char * dest, const unsigned char * const src,
unsigned char condition)
{
/* make sure assign is 0 or 1 in a time-constant manner */
@@ -78,6 +78,19 @@
}
/*
+ * Constant flow conditional assignment to uint_32
+*/
+static void mbedtls_base64_cond_assign_uint32(uint32_t * dest, const uint32_t src,
+ unsigned char condition)
+{
+ /* make sure assign is 0 or 1 in a time-constant manner */
+ condition = (condition | (unsigned char)-condition) >> 7;
+
+ *dest = ( *dest ) * ( 1 - condition ) + ( src ) * condition;
+}
+
+
+/*
* Constant flow check for equality
*/
static unsigned char mbedtls_base64_eq(size_t in_a, size_t in_b)
@@ -114,7 +127,7 @@
for( i = 0; i < table_size; ++i )
{
- mbedtls_base64_cond_assign(&result, &table[i], mbedtls_base64_eq(i, table_index));
+ mbedtls_base64_cond_assign_uchar(&result, &table[i], mbedtls_base64_eq(i, table_index));
}
return result;
@@ -275,7 +288,7 @@
dec_map_lookup = mbedtls_base64_table_lookup(base64_dec_map, sizeof( base64_dec_map ), *src );
- j -= ( dec_map_lookup == 64 );
+ mbedtls_base64_cond_assign_uint32( &j, j - 1, mbedtls_base64_eq( dec_map_lookup, 64 ) );
x = ( x << 6 ) | ( dec_map_lookup & 0x3F );
if( ++n == 4 )
