Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 492779: In PL_Base64Encode and PL_Base64Decode, ensure that all

Browse Source 
PRUint32 values stay within range.  In PL_strlen, replaced the magic
constant 2147483647 by PR_INT32_MAX.  r=nelson.
Modified Files: base64.c strlen.c


git-svn-id: svn://10.0.0.236/trunk@257203 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
wtc%google.com
2009-05-15 16:00:59 +00:00
parent 919abd8bed
commit 46b49ff85b
2 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
mozilla/nsprpub/lib/libc/src/base64.c
View File

@@ -155,7 +155,13 @@ PL_Base64Encode
if( (char *)0 == dest )
{
PRUint32 destlen = ((srclen + 2)/3) * 4;
PRUint32 destlen;
/* Ensure all PRUint32 values stay within range. */
if( srclen > (PR_UINT32_MAX/4) * 3 )
{
return (char *)0;
}
destlen = ((srclen + 2)/3) * 4;
dest = (char *)PR_MALLOC(destlen + 1);
if( (char *)0 == dest )
{
@@ -403,7 +409,9 @@ PL_Base64Decode
if( (char *)0 == dest )
{
PRUint32 destlen = ((srclen * 3) / 4);
/* The following computes ((srclen * 3) / 4) without overflow. */
PRUint32 rem = srclen % 4;
PRUint32 destlen = (srclen / 4) * 3 + (rem * 3) / 4;
dest = (char *)PR_MALLOC(destlen + 1);
if( (char *)0 == dest )
{

2
mozilla/nsprpub/lib/libc/src/strlen.c
View File

@@ -53,7 +53,7 @@ PL_strlen(const char *str)
* we don't have ultra long strings that overflow an int32
*/
if( sizeof(PRUint32) < sizeof(size_t) )
PR_ASSERT(l < 2147483647);
PR_ASSERT(l <= PR_INT32_MAX);
return (PRUint32)l;
}