Vulnerability: The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.
Vulnerability ID: CVE-2017-5209
CWE: CWE-125
Severity score: 4.9
Project: https://github.com/libimobiledevice/libplist
Published: 2017-01-11
File: src/base64.c
Commit message: base64: Rework base64decode to handle split encoded data correctly
Commit author: Nikias Bassen

Vulnerable version (before fix):
 static const signed char base64_table[256] = { 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63, 	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1, 	-1,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 	15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, 	-1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, size_t base64encode(char *outbuf, const unsigned char *buf, size_t size) 	return m; }  static int base64decode_block(unsigned char *target, const char *data, size_t data_size) { 	int w1,w2,w3,w4; 	int i; 	size_t n;  	if (!data || (data_size <= 0)) { 		return 0; 	}  	n = 0; 	i = 0; 	while (n < data_size-3) { 		w1 = base64_table[(int)data[n]]; 		w2 = base64_table[(int)data[n+1]]; 		w3 = base64_table[(int)data[n+2]]; 		w4 = base64_table[(int)data[n+3]];  		if (w2 >= 0) { 			target[i++] = (char)((w1*4 + (w2 >> 4)) & 255); 		} 		if (w3 >= 0) { 			target[i++] = (char)((w2*16 + (w3 >> 2)) & 255); 		} 		if (w4 >= 0) { 			target[i++] = (char)((w3*64 + w4) & 255); 		} 		n+=4; 	} 	return i; }  unsigned char *base64decode(const char *buf, size_t *size) { 	if (!buf || !size) return NULL; unsigned char *base64decode(const char *buf, size_t *size) 	unsigned char *outbuf = (unsigned char*)malloc((len/4)*3+3); 	const char *ptr = buf; 	int p = 0; 	size_t l = 0;  	do { 		ptr += strspn(ptr, "\r\n\t "); 		if (*ptr == '\0' || ptr >= buf+len) { 			break; 		} 		l = strcspn(ptr, "\r\n\t "); 		if (l > 3 && ptr+l <= buf+len) { 			p+=base64decode_block(outbuf+p, ptr, l); 			ptr += l; 		} else { 			break; 		} 	} while (1); 

Fixed version (after fix):
 static const signed char base64_table[256] = { 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63, 	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -2, -1, -1, 	-1,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14, 	15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1, 	-1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, size_t base64encode(char *outbuf, const unsigned char *buf, size_t size) 	return m; }  unsigned char *base64decode(const char *buf, size_t *size) { 	if (!buf || !size) return NULL; unsigned char *base64decode(const char *buf, size_t *size) 	unsigned char *outbuf = (unsigned char*)malloc((len/4)*3+3); 	const char *ptr = buf; 	int p = 0; 	int wv, w1, w2, w3, w4; 	int tmpval[4]; 	int tmpcnt = 0;  	do { 		while (ptr < buf+len && (*ptr == ' ' || *ptr == '\t' || *ptr == '\n' || *ptr == '\r')) { 			ptr++; 		} 		if (*ptr == '\0' || ptr >= buf+len) { 			break; 		} 		if ((wv = base64_table[(int)(unsigned char)*ptr++]) == -1) { 			continue; 		} 		tmpval[tmpcnt++] = wv; 		if (tmpcnt == 4) { 			tmpcnt = 0; 			w1 = tmpval[0]; 			w2 = tmpval[1]; 			w3 = tmpval[2]; 			w4 = tmpval[3];  			if (w2 >= 0) { 				outbuf[p++] = (unsigned char)(((w1 << 2) + (w2 >> 4)) & 0xFF); 			} 			if (w3 >= 0) { 				outbuf[p++] = (unsigned char)(((w2 << 4) + (w3 >> 2)) & 0xFF); 			} 			if (w4 >= 0) { 				outbuf[p++] = (unsigned char)(((w3 << 6) + w4) & 0xFF); 			} 		} 	} while (1); 

Patch:
patch: @@ -28,7 +28,7 @@ static const signed char base64_table[256] = {
 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,
-	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1,
+	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -2, -1, -1,
 	-1,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,
 	15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1,
 	-1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
@@ -71,38 +71,6 @@ size_t base64encode(char *outbuf, const unsigned char *buf, size_t size)
 	return m;
 }
 
-static int base64decode_block(unsigned char *target, const char *data, size_t data_size)
-{
-	int w1,w2,w3,w4;
-	int i;
-	size_t n;
-
-	if (!data || (data_size <= 0)) {
-		return 0;
-	}
-
-	n = 0;
-	i = 0;
-	while (n < data_size-3) {
-		w1 = base64_table[(int)data[n]];
-		w2 = base64_table[(int)data[n+1]];
-		w3 = base64_table[(int)data[n+2]];
-		w4 = base64_table[(int)data[n+3]];
-
-		if (w2 >= 0) {
-			target[i++] = (char)((w1*4 + (w2 >> 4)) & 255);
-		}
-		if (w3 >= 0) {
-			target[i++] = (char)((w2*16 + (w3 >> 2)) & 255);
-		}
-		if (w4 >= 0) {
-			target[i++] = (char)((w3*64 + w4) & 255);
-		}
-		n+=4;
-	}
-	return i;
-}
-
 unsigned char *base64decode(const char *buf, size_t *size)
 {
 	if (!buf || !size) return NULL;
@@ -111,19 +79,37 @@ unsigned char *base64decode(const char *buf, size_t *size)
 	unsigned char *outbuf = (unsigned char*)malloc((len/4)*3+3);
 	const char *ptr = buf;
 	int p = 0;
-	size_t l = 0;
+	int wv, w1, w2, w3, w4;
+	int tmpval[4];
+	int tmpcnt = 0;
 
 	do {
-		ptr += strspn(ptr, "\r\n\t ");
+		while (ptr < buf+len && (*ptr == ' ' || *ptr == '\t' || *ptr == '\n' || *ptr == '\r')) {
+			ptr++;
+		}
 		if (*ptr == '\0' || ptr >= buf+len) {
 			break;
 		}
-		l = strcspn(ptr, "\r\n\t ");
-		if (l > 3 && ptr+l <= buf+len) {
-			p+=base64decode_block(outbuf+p, ptr, l);
-			ptr += l;
-		} else {
-			break;
+		if ((wv = base64_table[(int)(unsigned char)*ptr++]) == -1) {
+			continue;
+		}
+		tmpval[tmpcnt++] = wv;
+		if (tmpcnt == 4) {
+			tmpcnt = 0;
+			w1 = tmpval[0];
+			w2 = tmpval[1];
+			w3 = tmpval[2];
+			w4 = tmpval[3];
+
+			if (w2 >= 0) {
+				outbuf[p++] = (unsigned char)(((w1 << 2) + (w2 >> 4)) & 0xFF);
+			}
+			if (w3 >= 0) {
+				outbuf[p++] = (unsigned char)(((w2 << 4) + (w3 >> 2)) & 0xFF);
+			}
+			if (w4 >= 0) {
+				outbuf[p++] = (unsigned char)(((w3 << 6) + w4) & 0xFF);
+			}
 		}
 	} while (1);
path: src/base64.c