* [PATCH v2 0/2] Fix out-of-bounds potential in decode_base64 and add regression tests
@ 2025-12-02 9:22 Jonas Rebmann
2025-12-02 9:22 ` [PATCH v2 1/2] lib: base64: Fix out-of-bounds potential by respecting dst_len Jonas Rebmann
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Jonas Rebmann @ 2025-12-02 9:22 UTC (permalink / raw)
To: Sascha Hauer, BAREBOX; +Cc: Jonas Rebmann
I took a closer look at decode_base64 while reviewing coverity report
584740 (Out-of-bounds access). 1/2 resolves the issue (although coverity
seems to suspect an out-of-bounds access for the wrong reason and might
keep doing so), 2/2 adds a selftest I used to debug the issue.
Signed-off-by: Jonas Rebmann <jre@pengutronix.de>
---
Changes in v2:
- correct name of helper function from __expect_streq() to
__expect_base64()
- Link to v1: https://lore.barebox.org/barebox/20251201-base64-bounds-v1-0-3ae2b2e8b7cb@pengutronix.de
---
Jonas Rebmann (2):
lib: base64: Fix out-of-bounds potential by respecting dst_len
test: self: add base64 selftests
lib/base64.c | 10 +++++-----
test/self/Kconfig | 7 +++++++
test/self/Makefile | 1 +
test/self/base64.c | 45 +++++++++++++++++++++++++++++++++++++++++++++
4 files changed, 58 insertions(+), 5 deletions(-)
---
base-commit: ec00fef65d808f8bc9c5655262b0e4f8ce2c4e92
change-id: 20251201-base64-bounds-ed379c2c6ff7
Best regards,
--
Jonas Rebmann <jre@pengutronix.de>
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH v2 1/2] lib: base64: Fix out-of-bounds potential by respecting dst_len 2025-12-02 9:22 [PATCH v2 0/2] Fix out-of-bounds potential in decode_base64 and add regression tests Jonas Rebmann @ 2025-12-02 9:22 ` Jonas Rebmann 2025-12-03 8:59 ` Sascha Hauer 2025-12-02 9:22 ` [PATCH v2 2/2] test: self: add base64 selftests Jonas Rebmann 2025-12-08 7:45 ` [PATCH v2 0/2] Fix out-of-bounds potential in decode_base64 and add regression tests Sascha Hauer 2 siblings, 1 reply; 6+ messages in thread From: Jonas Rebmann @ 2025-12-02 9:22 UTC (permalink / raw) To: Sascha Hauer, BAREBOX; +Cc: Jonas Rebmann __decode_base64 generally writes the input in 3 bytes increments, corresponding to 4 bytes increments in the base64 input buffer. This means that in order to respect dst_len as the size of the output buffer, the case of exceeding dst_len within a loop iteration must be considered. In such a case, refrain from writing the last one or two bytes if that write would be past dst_len. Signed-off-by: Jonas Rebmann <jre@pengutronix.de> --- lib/base64.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lib/base64.c b/lib/base64.c index d5ab217528..3e29f0a56c 100644 --- a/lib/base64.c +++ b/lib/base64.c @@ -163,19 +163,19 @@ static int __decode_base64(char *p_dst, int dst_len, const char *src, bool url) */ if (count > 1) *dst++ = six_bit[0] << 2 | six_bit[1] >> 4; - if (count > 2) + if (count > 2 && dst_len > 1) *dst++ = six_bit[1] << 4 | six_bit[2] >> 2; - if (count > 3) + if (count > 3 && dst_len > 2) *dst++ = six_bit[2] << 6 | six_bit[3]; + /* last character was "=" */ + if (count != 0) + length += min(count - 1, dst_len); /* * Note that if we decode "AA==" and ate first '=', * we just decoded one char (count == 2) and now we'll * do the loop once more to decode second '='. */ dst_len -= count-1; - /* last character was "=" */ - if (count != 0) - length += count - 1; } ret: p_dst = dst; -- 2.51.2.535.g419c72cb8a ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 1/2] lib: base64: Fix out-of-bounds potential by respecting dst_len 2025-12-02 9:22 ` [PATCH v2 1/2] lib: base64: Fix out-of-bounds potential by respecting dst_len Jonas Rebmann @ 2025-12-03 8:59 ` Sascha Hauer 2025-12-03 12:01 ` Ahmad Fatoum 0 siblings, 1 reply; 6+ messages in thread From: Sascha Hauer @ 2025-12-03 8:59 UTC (permalink / raw) To: Jonas Rebmann; +Cc: BAREBOX On Tue, Dec 02, 2025 at 10:22:44AM +0100, Jonas Rebmann wrote: > __decode_base64 generally writes the input in 3 bytes increments, > corresponding to 4 bytes increments in the base64 input buffer. This > means that in order to respect dst_len as the size of the output buffer, > the case of exceeding dst_len within a loop iteration must be > considered. > > In such a case, refrain from writing the last one or two bytes if that > write would be past dst_len. > > Signed-off-by: Jonas Rebmann <jre@pengutronix.de> > --- > lib/base64.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) I wonder if we should switch to the kernel functions from lib/base64.c instead. They look much more straight forward than the busybox based implementation. Sascha > > diff --git a/lib/base64.c b/lib/base64.c > index d5ab217528..3e29f0a56c 100644 > --- a/lib/base64.c > +++ b/lib/base64.c > @@ -163,19 +163,19 @@ static int __decode_base64(char *p_dst, int dst_len, const char *src, bool url) > */ > if (count > 1) > *dst++ = six_bit[0] << 2 | six_bit[1] >> 4; > - if (count > 2) > + if (count > 2 && dst_len > 1) > *dst++ = six_bit[1] << 4 | six_bit[2] >> 2; > - if (count > 3) > + if (count > 3 && dst_len > 2) > *dst++ = six_bit[2] << 6 | six_bit[3]; > + /* last character was "=" */ > + if (count != 0) > + length += min(count - 1, dst_len); > /* > * Note that if we decode "AA==" and ate first '=', > * we just decoded one char (count == 2) and now we'll > * do the loop once more to decode second '='. > */ > dst_len -= count-1; > - /* last character was "=" */ > - if (count != 0) > - length += count - 1; > } > ret: > p_dst = dst; > > -- > 2.51.2.535.g419c72cb8a > > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 1/2] lib: base64: Fix out-of-bounds potential by respecting dst_len 2025-12-03 8:59 ` Sascha Hauer @ 2025-12-03 12:01 ` Ahmad Fatoum 0 siblings, 0 replies; 6+ messages in thread From: Ahmad Fatoum @ 2025-12-03 12:01 UTC (permalink / raw) To: Sascha Hauer, Jonas Rebmann; +Cc: BAREBOX Hi Sascha, On 12/3/25 9:59 AM, Sascha Hauer wrote: > On Tue, Dec 02, 2025 at 10:22:44AM +0100, Jonas Rebmann wrote: >> __decode_base64 generally writes the input in 3 bytes increments, >> corresponding to 4 bytes increments in the base64 input buffer. This >> means that in order to respect dst_len as the size of the output buffer, >> the case of exceeding dst_len within a loop iteration must be >> considered. >> >> In such a case, refrain from writing the last one or two bytes if that >> write would be past dst_len. >> >> Signed-off-by: Jonas Rebmann <jre@pengutronix.de> >> --- >> lib/base64.c | 10 +++++----- >> 1 file changed, 5 insertions(+), 5 deletions(-) > > I wonder if we should switch to the kernel functions from lib/base64.c > instead. They look much more straight forward than the busybox based > implementation. Just need to take care to support base64url, which is needed for the JSON web token support. Cheers, Ahmad > > Sascha > >> >> diff --git a/lib/base64.c b/lib/base64.c >> index d5ab217528..3e29f0a56c 100644 >> --- a/lib/base64.c >> +++ b/lib/base64.c >> @@ -163,19 +163,19 @@ static int __decode_base64(char *p_dst, int dst_len, const char *src, bool url) >> */ >> if (count > 1) >> *dst++ = six_bit[0] << 2 | six_bit[1] >> 4; >> - if (count > 2) >> + if (count > 2 && dst_len > 1) >> *dst++ = six_bit[1] << 4 | six_bit[2] >> 2; >> - if (count > 3) >> + if (count > 3 && dst_len > 2) >> *dst++ = six_bit[2] << 6 | six_bit[3]; >> + /* last character was "=" */ >> + if (count != 0) >> + length += min(count - 1, dst_len); >> /* >> * Note that if we decode "AA==" and ate first '=', >> * we just decoded one char (count == 2) and now we'll >> * do the loop once more to decode second '='. >> */ >> dst_len -= count-1; >> - /* last character was "=" */ >> - if (count != 0) >> - length += count - 1; >> } >> ret: >> p_dst = dst; >> >> -- >> 2.51.2.535.g419c72cb8a >> >> > -- Pengutronix e.K. | | Steuerwalder Str. 21 | http://www.pengutronix.de/ | 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 | Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 | ^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2 2/2] test: self: add base64 selftests 2025-12-02 9:22 [PATCH v2 0/2] Fix out-of-bounds potential in decode_base64 and add regression tests Jonas Rebmann 2025-12-02 9:22 ` [PATCH v2 1/2] lib: base64: Fix out-of-bounds potential by respecting dst_len Jonas Rebmann @ 2025-12-02 9:22 ` Jonas Rebmann 2025-12-08 7:45 ` [PATCH v2 0/2] Fix out-of-bounds potential in decode_base64 and add regression tests Sascha Hauer 2 siblings, 0 replies; 6+ messages in thread From: Jonas Rebmann @ 2025-12-02 9:22 UTC (permalink / raw) To: Sascha Hauer, BAREBOX; +Cc: Jonas Rebmann These tests are specifically tailored around respecting the dst_len parameter. Signed-off-by: Jonas Rebmann <jre@pengutronix.de> --- test/self/Kconfig | 7 +++++++ test/self/Makefile | 1 + test/self/base64.c | 45 +++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 53 insertions(+) diff --git a/test/self/Kconfig b/test/self/Kconfig index 936b12072e..adef8609ef 100644 --- a/test/self/Kconfig +++ b/test/self/Kconfig @@ -28,6 +28,7 @@ config SELFTEST_AUTORUN config SELFTEST_ENABLE_ALL bool "Enable all self-tests" + select SELFTEST_BASE64 select SELFTEST_RANGE select SELFTEST_PRINTF select SELFTEST_MALLOC @@ -52,6 +53,12 @@ config SELFTEST_ENABLE_ALL help Selects all self-tests compatible with current configuration +config SELFTEST_BASE64 + bool "base64 selftest" + select BASE64 + help + Tests base64 implementation + config SELFTEST_RANGE bool "range.h selftest" help diff --git a/test/self/Makefile b/test/self/Makefile index 0bd947928a..d244c19052 100644 --- a/test/self/Makefile +++ b/test/self/Makefile @@ -1,6 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 obj-$(CONFIG_SELFTEST) += core.o +obj-$(CONFIG_SELFTEST_BASE64) += base64.o obj-$(CONFIG_SELFTEST_RANGE) += range.o obj-$(CONFIG_SELFTEST_MALLOC) += malloc.o obj-$(CONFIG_SELFTEST_TALLOC) += talloc.o diff --git a/test/self/base64.c b/test/self/base64.c new file mode 100644 index 0000000000..c9140aedb9 --- /dev/null +++ b/test/self/base64.c @@ -0,0 +1,45 @@ +// SPDX-License-Identifier: GPL-2.0-only + +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +#include <common.h> +#include <bselftest.h> +#include <base64.h> +#include <string.h> + +BSELFTEST_GLOBALS(); + +static void __expect_base64(const char *func, int line, int dst_len, + const char *src, int expect_len, const char *expect) +{ + int ret; + char *buf = strdup("canary"); + bool fail = false; + + total_tests++; + ret = decode_base64(buf, dst_len, src); + if (!streq_ptr(buf, expect)) { + fail = true; + printf("%s:%d: got '%s', but '%s' expected\n", func, line, buf, + expect); + } + if (ret != expect_len) { + fail = true; + printf("%s:%d: got length %i, but %i expected\n", func, line, + ret, expect_len); + } + if (fail) + failed_tests++; + free(buf); +} + +#define expect_base64(dst_len, src, expect_len, expect) \ + __expect_base64(__func__, __LINE__, dst_len, src, expect_len, expect) + +static void test_base64(void) +{ + expect_base64(1, "QUJD", 1, "Aanary"); + expect_base64(5, "QUJD", 3, "ABCary"); + expect_base64(5, "$UJD", 0, "canary"); +} +bselftest(parser, test_base64); -- 2.51.2.535.g419c72cb8a ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 0/2] Fix out-of-bounds potential in decode_base64 and add regression tests 2025-12-02 9:22 [PATCH v2 0/2] Fix out-of-bounds potential in decode_base64 and add regression tests Jonas Rebmann 2025-12-02 9:22 ` [PATCH v2 1/2] lib: base64: Fix out-of-bounds potential by respecting dst_len Jonas Rebmann 2025-12-02 9:22 ` [PATCH v2 2/2] test: self: add base64 selftests Jonas Rebmann @ 2025-12-08 7:45 ` Sascha Hauer 2 siblings, 0 replies; 6+ messages in thread From: Sascha Hauer @ 2025-12-08 7:45 UTC (permalink / raw) To: BAREBOX, Jonas Rebmann On Tue, 02 Dec 2025 10:22:43 +0100, Jonas Rebmann wrote: > I took a closer look at decode_base64 while reviewing coverity report > 584740 (Out-of-bounds access). 1/2 resolves the issue (although coverity > seems to suspect an out-of-bounds access for the wrong reason and might > keep doing so), 2/2 adds a selftest I used to debug the issue. > > Applied, thanks! [1/2] lib: base64: Fix out-of-bounds potential by respecting dst_len https://git.pengutronix.de/cgit/barebox/commit/?id=fd1a97622105 (link may not be stable) [2/2] test: self: add base64 selftests https://git.pengutronix.de/cgit/barebox/commit/?id=c5190aac91f2 (link may not be stable) Best regards, -- Sascha Hauer <s.hauer@pengutronix.de> ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-12-08 7:45 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2025-12-02 9:22 [PATCH v2 0/2] Fix out-of-bounds potential in decode_base64 and add regression tests Jonas Rebmann 2025-12-02 9:22 ` [PATCH v2 1/2] lib: base64: Fix out-of-bounds potential by respecting dst_len Jonas Rebmann 2025-12-03 8:59 ` Sascha Hauer 2025-12-03 12:01 ` Ahmad Fatoum 2025-12-02 9:22 ` [PATCH v2 2/2] test: self: add base64 selftests Jonas Rebmann 2025-12-08 7:45 ` [PATCH v2 0/2] Fix out-of-bounds potential in decode_base64 and add regression tests Sascha Hauer
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox