Fix integer overflow mbedtls_base64_decode()
Fix potential integer overflows in the function mbedtls_base64_decode().
This overflow would mainly be exploitable in 32-bit systems and could
cause buffer bound checks to be bypassed.
diff --git a/ChangeLog b/ChangeLog
index fc240c3..76cd298 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -27,6 +27,8 @@
cause buffer bound checks to be bypassed. Found by Eyal Itkin.
* Fixed potential arithmetic overflow in mbedtls_md2_update() that could
cause buffer bound checks to be bypassed. Found by Eyal Itkin.
+ * Fixed potential arithmetic overflow in mbedtls_base64_decode() that could
+ cause buffer bound checks to be bypassed. Found by Eyal Itkin.
= mbed TLS 2.4.1 branch released 2016-12-13
diff --git a/library/base64.c b/library/base64.c
index 5cb12cb..305afc5 100644
--- a/library/base64.c
+++ b/library/base64.c
@@ -192,7 +192,7 @@
return( 0 );
}
- n = ( ( n * 6 ) + 7 ) >> 3;
+ n = ( 6 * ( n >> 3 ) ) + ( ( 6 * ( n & 0x7 ) + 7 ) >> 3 );
n -= j;
if( dst == NULL || dlen < n )
