CVE-2017-5209: Out-of-bounds Read (CWE-125)
value: The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 9.1
Published: 2017-01-11T16:59Z
Repository: https://github.com/libimobiledevice/libplist
Language: C
Files changed: src/base64.c
Commit date: 2017-01-11 03:49:31 +0100
Commit message: base64: Rework base64decode to handle split encoded data correctly

Diff: diff --git a/src/base64.c b/src/base64.c
index 7870a79..ba8acca 100644
--- a/src/base64.c
+++ b/src/base64.c
@@ -26,11 +26,11 @@ static const char base64_pad = '=';
 
 static const signed char base64_table[256] = {
 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,
-	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1,
+	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -2, -1, -1,
 	-1,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,
 	15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1,
 	-1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
 	41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, -1, -1, -1, -1, -1,
 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
@@ -69,63 +69,49 @@ size_t base64encode(char *outbuf, const unsigned char *buf, size_t size)
 	}
 	outbuf[m] = 0; // 0-termination!
 	return m;
 }
 
-static int base64decode_block(unsigned char *target, const char *data, size_t data_size)
-{
-	int w1,w2,w3,w4;
-	int i;
-	size_t n;
-
-	if (!data || (data_size <= 0)) {
-		return 0;
-	}
-
-	n = 0;
-	i = 0;
-	while (n < data_size-3) {
-		w1 = base64_table[(int)data[n]];
-		w2 = base64_table[(int)data[n+1]];
-		w3 = base64_table[(int)data[n+2]];
-		w4 = base64_table[(int)data[n+3]];
-
-		if (w2 >= 0) {
-			target[i++] = (char)((w1*4 + (w2 >> 4)) & 255);
-		}
-		if (w3 >= 0) {
-			target[i++] = (char)((w2*16 + (w3 >> 2)) & 255);
-		}
-		if (w4 >= 0) {
-			target[i++] = (char)((w3*64 + w4) & 255);
-		}
-		n+=4;
-	}
-	return i;
-}
-
 unsigned char *base64decode(const char *buf, size_t *size)
 {
 	if (!buf || !size) return NULL;
 	size_t len = (*size > 0) ? *size : strlen(buf);
 	if (len <= 0) return NULL;
 	unsigned char *outbuf = (unsigned char*)malloc((len/4)*3+3);
 	const char *ptr = buf;
 	int p = 0;
-	size_t l = 0;
+	int wv, w1, w2, w3, w4;
+	int tmpval[4];
+	int tmpcnt = 0;
 
 	do {
-		ptr += strspn(ptr, "\r\n\t ");
+		while (ptr < buf+len && (*ptr == ' ' || *ptr == '\t' || *ptr == '\n' || *ptr == '\r')) {
+			ptr++;
+		}
 		if (*ptr == '\0' || ptr >= buf+len) {
 			break;
 		}
-		l = strcspn(ptr, "\r\n\t ");
-		if (l > 3 && ptr+l <= buf+len) {
-			p+=base64decode_block(outbuf+p, ptr, l);
-			ptr += l;
-		} else {
-			break;
+		if ((wv = base64_table[(int)(unsigned char)*ptr++]) == -1) {
+			continue;
+		}
+		tmpval[tmpcnt++] = wv;
+		if (tmpcnt == 4) {
+			tmpcnt = 0;
+			w1 = tmpval[0];
+			w2 = tmpval[1];
+			w3 = tmpval[2];
+			w4 = tmpval[3];
+
+			if (w2 >= 0) {
+				outbuf[p++] = (unsigned char)(((w1 << 2) + (w2 >> 4)) & 0xFF);
+			}
+			if (w3 >= 0) {
+				outbuf[p++] = (unsigned char)(((w2 << 4) + (w3 >> 2)) & 0xFF);
+			}
+			if (w4 >= 0) {
+				outbuf[p++] = (unsigned char)(((w3 << 6) + w4) & 0xFF);
+			}
 		}
 	} while (1);
 
 	outbuf[p] = 0;
 	*size = p;

Vulnerable code: 	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1,
static int base64decode_block(unsigned char *target, const char *data, size_t data_size)
{
	int w1,w2,w3,w4;
	int i;
	size_t n;

	if (!data || (data_size <= 0)) {
		return 0;
	}

	n = 0;
	i = 0;
	while (n < data_size-3) {
		w1 = base64_table[(int)data[n]];
		w2 = base64_table[(int)data[n+1]];
		w3 = base64_table[(int)data[n+2]];
		w4 = base64_table[(int)data[n+3]];

		if (w2 >= 0) {
			target[i++] = (char)((w1*4 + (w2 >> 4)) & 255);
		}
		if (w3 >= 0) {
			target[i++] = (char)((w2*16 + (w3 >> 2)) & 255);
		}
		if (w4 >= 0) {
			target[i++] = (char)((w3*64 + w4) & 255);
		}
		n+=4;
	}
	return i;
}

	size_t l = 0;
		ptr += strspn(ptr, "\r\n\t ");
		l = strcspn(ptr, "\r\n\t ");
		if (l > 3 && ptr+l <= buf+len) {
			p+=base64decode_block(outbuf+p, ptr, l);
			ptr += l;
		} else {
			break;
Fixed code: 	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -2, -1, -1,
	int wv, w1, w2, w3, w4;
	int tmpval[4];
	int tmpcnt = 0;
		while (ptr < buf+len && (*ptr == ' ' || *ptr == '\t' || *ptr == '\n' || *ptr == '\r')) {
			ptr++;
		}
		if ((wv = base64_table[(int)(unsigned char)*ptr++]) == -1) {
			continue;
		}
		tmpval[tmpcnt++] = wv;
		if (tmpcnt == 4) {
			tmpcnt = 0;
			w1 = tmpval[0];
			w2 = tmpval[1];
			w3 = tmpval[2];
			w4 = tmpval[3];

			if (w2 >= 0) {
				outbuf[p++] = (unsigned char)(((w1 << 2) + (w2 >> 4)) & 0xFF);
			}
			if (w3 >= 0) {
				outbuf[p++] = (unsigned char)(((w2 << 4) + (w3 >> 2)) & 0xFF);
			}
			if (w4 >= 0) {
				outbuf[p++] = (unsigned char)(((w3 << 6) + w4) & 0xFF);
			}