diff options
| author | Hans Jerry Illikainen <hji@dyntopia.com> | 2016-12-11 20:17:49 +0000 |
|---|---|---|
| committer | Nick Mathewson <nickm@torproject.org> | 2016-12-23 09:47:09 -0500 |
| commit | a23fd1578612051a3ac804c12a629f6a5cfa296e (patch) | |
| tree | 7b64f7ab79efaf2469efefbe60bbcec46f5aed59 /src/test/test_util_format.c | |
| parent | f3da62dbdfb2057a7c8d5d46367e9d41bdd5b9ec (diff) | |
| download | tor-a23fd1578612051a3ac804c12a629f6a5cfa296e.tar.gz tor-a23fd1578612051a3ac804c12a629f6a5cfa296e.zip | |
Fix unreachable heap corruption in base64_decode()
Give size_mul_check() external linkage and use it in base64_decode() to
avoid a potential integer wrap.
Closes #19222
Diffstat (limited to 'src/test/test_util_format.c')
| -rw-r--r-- | src/test/test_util_format.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/test/test_util_format.c b/src/test/test_util_format.c index 1d58ba2bf8..21a6923c6d 100644 --- a/src/test/test_util_format.c +++ b/src/test/test_util_format.c @@ -202,6 +202,9 @@ test_util_format_base64_decode(void *ignored) res = base64_decode(dst, SIZE_T_CEILING+1, src, 10); tt_int_op(res, OP_EQ, -1); + res = base64_decode(dst, 1, real_src, SIZE_MAX/3+1); + tt_int_op(res, OP_EQ, -1); + const char *s = "T3BhIG11bmRv"; res = base64_decode(dst, 9, s, strlen(s)); tt_int_op(res, OP_EQ, 9); |