Blame SOURCES/aide-0.16-CVE-2021-45417.patch

1e4393
diff --git a/include/base64.h b/include/base64.h
1e4393
index 0ff7116..381ef5d 100644
1e4393
--- a/include/base64.h
1e4393
+++ b/include/base64.h
1e4393
@@ -36,7 +36,6 @@
1e4393
 #include <assert.h>
1e4393
 #include "types.h"
1e4393
 
1e4393
-#define B64_BUF 16384
1e4393
 #define FAIL -1
1e4393
 #define SKIP -2
1e4393
 
1e4393
diff --git a/src/base64.c b/src/base64.c
1e4393
index fd01bac..1b0f301 100644
1e4393
--- a/src/base64.c
1e4393
+++ b/src/base64.c
1e4393
@@ -85,11 +85,9 @@ FAIL, FAIL, FAIL, FAIL, FAIL, FAIL, FAIL, FAIL
1e4393
 };
1e4393
 
1e4393
 /* Returns NULL on error */
1e4393
-/* FIXME Possible buffer overflow on outputs larger than B64_BUF */
1e4393
 char* encode_base64(byte* src,size_t ssize)
1e4393
 {
1e4393
   char* outbuf;
1e4393
-  char* retbuf;
1e4393
   int pos;
1e4393
   int i, l, left;
1e4393
   unsigned long triple;
1e4393
@@ -101,7 +99,10 @@ char* encode_base64(byte* src,size_t ssize)
1e4393
     error(240,"\n");
1e4393
     return NULL;
1e4393
   }
1e4393
-  outbuf = (char *)malloc(sizeof(char)*B64_BUF);
1e4393
+
1e4393
+  /* length of encoded base64 string (padded) */
1e4393
+  size_t length = sizeof(char)* ((ssize + 2) / 3) * 4;
1e4393
+  outbuf = (char *)malloc(length + 1);
1e4393
   
1e4393
   /* Initialize working pointers */
1e4393
   inb = src;
1e4393
@@ -162,20 +163,14 @@ char* encode_base64(byte* src,size_t ssize)
1e4393
       inb++;
1e4393
   }
1e4393
   
1e4393
-  /* outbuf is not completely used so we use retbuf */
1e4393
-  retbuf=(char*)malloc(sizeof(char)*(pos+1));
1e4393
-  memcpy(retbuf,outbuf,pos);
1e4393
-  retbuf[pos]='\0';
1e4393
-  free(outbuf);
1e4393
+  outbuf[pos]='\0';
1e4393
 
1e4393
-  return retbuf;
1e4393
+  return outbuf;
1e4393
 }
1e4393
 
1e4393
-/* FIXME Possible buffer overflow on outputs larger than B64_BUF */
1e4393
 byte* decode_base64(char* src,size_t ssize, size_t *ret_len)
1e4393
 {
1e4393
   byte* outbuf;
1e4393
-  byte* retbuf;
1e4393
   char* inb;
1e4393
   int i;
1e4393
   int l;
1e4393
@@ -188,10 +183,18 @@ byte* decode_base64(char* src,size_t ssize, size_t *ret_len)
1e4393
   if (!ssize||src==NULL)
1e4393
     return NULL;
1e4393
 
1e4393
+  /* exit on unpadded input */
1e4393
+  if (ssize % 4) {
1e4393
+    error(3, "decode_base64: '%s' has invalid length (missing padding characters?)", src);
1e4393
+    return NULL;
1e4393
+  }
1e4393
+
1e4393
+  /* calculate length of decoded string, substract padding chars if any (ssize is >= 4) */
1e4393
+  size_t length = sizeof(byte) * ((ssize / 4) * 3)- (src[ssize-1] == '=') - (src[ssize-2] == '=');
1e4393
 
1e4393
   /* Initialize working pointers */
1e4393
   inb = src;
1e4393
-  outbuf = (byte *)malloc(sizeof(byte)*B64_BUF);
1e4393
+  outbuf = (byte *)malloc(length + 1);
1e4393
 
1e4393
   l = 0;
1e4393
   triple = 0;
1e4393
@@ -243,15 +246,11 @@ byte* decode_base64(char* src,size_t ssize, size_t *ret_len)
1e4393
       inb++;
1e4393
     }
1e4393
   
1e4393
-  retbuf=(byte*)malloc(sizeof(byte)*(pos+1));
1e4393
-  memcpy(retbuf,outbuf,pos);
1e4393
-  retbuf[pos]='\0';
1e4393
-  
1e4393
-  free(outbuf);
1e4393
+  outbuf[pos]='\0';
1e4393
 
1e4393
   if (ret_len) *ret_len = pos;
1e4393
   
1e4393
-  return retbuf;
1e4393
+  return outbuf;
1e4393
 }
1e4393
 
1e4393
 size_t length_base64(char* src,size_t ssize)
1e4393
diff --git a/src/db.c b/src/db.c
1e4393
index 858240d..62c4faa 100644
1e4393
--- a/src/db.c
1e4393
+++ b/src/db.c
1e4393
@@ -664,13 +664,15 @@ db_line* db_char2line(char** ss,int db){
1e4393
 
1e4393
 time_t base64totime_t(char* s){
1e4393
   
1e4393
+  if(strcmp(s,"0")==0){
1e4393
+      return 0;
1e4393
+  }
1e4393
   byte* b=decode_base64(s,strlen(s),NULL);
1e4393
   char* endp;
1e4393
   
1e4393
-  if (b==NULL||strcmp(s,"0")==0) {
1e4393
+  if (b==NULL) {
1e4393
     
1e4393
     /* Should we print error here? */
1e4393
-    free(b);
1e4393
     
1e4393
     return 0;
1e4393
   } else {