RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-07-27 06:37:44 +00:00
Code Issues Activity Actions

AK: Don't crash on invalid Base64 input

Browse source 
In the long-term, we should probably have a way to signal decoding
failure. For now, it should suffice to at least not crash. This is
particularly relevant because apparently this can be triggered while
parsing a PEM certificate, which happens during every TLS connection.

Found by OSS Fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38979
This commit is contained in:
Ben Wiederhake 2021-10-22 23:17:54 +02:00 • committed by Linus Groh
parent 20f73d2abc
commit 3bf1f7ae87
2 changed files with 9 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
AK/Base64.cpp
View file

@ -61,7 +61,7 @@ ByteBuffer decode_base64(const StringView& input)
*is_padding = true;
return 0;
}
return table[input[offset]];
return table[static_cast<unsigned char>(input[offset])];
};
Vector<u8> output;

8
Tests/AK/TestBase64.cpp
View file

@ -27,6 +27,14 @@ TEST_CASE(test_decode)
decode_equal("Zm9vYmFy", "foobar");
}
TEST_CASE(test_decode_nocrash)
{
// Any output is fine, we only check that we don't crash here.
decode_base64(StringView("asdf\xffqwer"));
decode_base64(StringView("asdf\x80qwer"));
// TODO: Handle decoding failure.
}
TEST_CASE(test_encode)
{
auto encode_equal = [&](const char* input, const char* expected) {