From 46b49ff85b4d997a18b408db71d5d69262995633 Mon Sep 17 00:00:00 2001 From: "wtc%google.com" Date: Fri, 15 May 2009 16:00:59 +0000 Subject: [PATCH] Bug 492779: In PL_Base64Encode and PL_Base64Decode, ensure that all PRUint32 values stay within range. In PL_strlen, replaced the magic constant 2147483647 by PR_INT32_MAX. r=nelson. Modified Files: base64.c strlen.c git-svn-id: svn://10.0.0.236/trunk@257203 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/nsprpub/lib/libc/src/base64.c | 12 ++++++++++-- mozilla/nsprpub/lib/libc/src/strlen.c | 2 +- 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/mozilla/nsprpub/lib/libc/src/base64.c b/mozilla/nsprpub/lib/libc/src/base64.c index 234d60d8fbf..0f6127574f0 100644 --- a/mozilla/nsprpub/lib/libc/src/base64.c +++ b/mozilla/nsprpub/lib/libc/src/base64.c @@ -155,7 +155,13 @@ PL_Base64Encode if( (char *)0 == dest ) { - PRUint32 destlen = ((srclen + 2)/3) * 4; + PRUint32 destlen; + /* Ensure all PRUint32 values stay within range. */ + if( srclen > (PR_UINT32_MAX/4) * 3 ) + { + return (char *)0; + } + destlen = ((srclen + 2)/3) * 4; dest = (char *)PR_MALLOC(destlen + 1); if( (char *)0 == dest ) { @@ -403,7 +409,9 @@ PL_Base64Decode if( (char *)0 == dest ) { - PRUint32 destlen = ((srclen * 3) / 4); + /* The following computes ((srclen * 3) / 4) without overflow. */ + PRUint32 rem = srclen % 4; + PRUint32 destlen = (srclen / 4) * 3 + (rem * 3) / 4; dest = (char *)PR_MALLOC(destlen + 1); if( (char *)0 == dest ) { diff --git a/mozilla/nsprpub/lib/libc/src/strlen.c b/mozilla/nsprpub/lib/libc/src/strlen.c index 6c47677727b..5cbc2b7ab1d 100644 --- a/mozilla/nsprpub/lib/libc/src/strlen.c +++ b/mozilla/nsprpub/lib/libc/src/strlen.c @@ -53,7 +53,7 @@ PL_strlen(const char *str) * we don't have ultra long strings that overflow an int32 */ if( sizeof(PRUint32) < sizeof(size_t) ) - PR_ASSERT(l < 2147483647); + PR_ASSERT(l <= PR_INT32_MAX); return (PRUint32)l; }