CVE-2017-5209 (published 2017-01-11T16:59Z)

The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.

Severity: MEDIUM
CVSS v2 base score: 6.4 (AV:N/AC:L/Au:N/C:P/I:N/A:P)
CVSS v3 base score: 9.1, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

Weakness information:
cwe_id: CWE-125
cwe_name: Out-of-bounds Read
description: The product reads data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/libimobiledevice/libplist
commit_details: repo_url: https://github.com/libimobiledevice/libplist
author: Nikias Bassen
author_date: 2017-01-11 03:49:31+01:00
msg: base64: Rework base64decode to handle split encoded data correctly
repository: repo_url: https://github.com/libimobiledevice/libplist
repo_name: libimobiledevice/libplist
description: A library to handle Apple Property List format in binary or XML
repo_language: C
owner: libimobiledevice
file_changes: filename: base64.c
change_type: ModificationType.MODIFY
diff: @@ -28,7 +28,7 @@ static const signed char base64_table[256] = {
 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1,
 	-1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 62, -1, -1, -1, 63,
-	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -1, -1, -1,
+	52, 53, 54, 55, 56, 57, 58, 59, 60, 61, -1, -1, -1, -2, -1, -1,
 	-1,  0,  1,  2,  3,  4,  5,  6,  7,  8,  9, 10, 11, 12, 13, 14,
 	15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, -1, -1, -1, -1, -1,
 	-1, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
@@ -71,38 +71,6 @@ size_t base64encode(char *outbuf, const unsigned char *buf, size_t size)
 	return m;
 }
 
-static int base64decode_block(unsigned char *target, const char *data, size_t data_size)
-{
-	int w1,w2,w3,w4;
-	int i;
-	size_t n;
-
-	if (!data || (data_size <= 0)) {
-		return 0;
-	}
-
-	n = 0;
-	i = 0;
-	while (n < data_size-3) {
-		w1 = base64_table[(int)data[n]];
-		w2 = base64_table[(int)data[n+1]];
-		w3 = base64_table[(int)data[n+2]];
-		w4 = base64_table[(int)data[n+3]];
-
-		if (w2 >= 0) {
-			target[i++] = (char)((w1*4 + (w2 >> 4)) & 255);
-		}
-		if (w3 >= 0) {
-			target[i++] = (char)((w2*16 + (w3 >> 2)) & 255);
-		}
-		if (w4 >= 0) {
-			target[i++] = (char)((w3*64 + w4) & 255);
-		}
-		n+=4;
-	}
-	return i;
-}
-
 unsigned char *base64decode(const char *buf, size_t *size)
 {
 	if (!buf || !size) return NULL;
@@ -111,19 +79,37 @@ unsigned char *base64decode(const char *buf, size_t *size)
 	unsigned char *outbuf = (unsigned char*)malloc((len/4)*3+3);
 	const char *ptr = buf;
 	int p = 0;
-	size_t l = 0;
+	int wv, w1, w2, w3, w4;
+	int tmpval[4];
+	int tmpcnt = 0;
 
 	do {
-		ptr += strspn(ptr, "\r\n\t ");
+		while (ptr < buf+len && (*ptr == ' ' || *ptr == '\t' || *ptr == '\n' || *ptr == '\r')) {
+			ptr++;
+		}
 		if (*ptr == '\0' || ptr >= buf+len) {
 			break;
 		}
-		l = strcspn(ptr, "\r\n\t ");
-		if (l > 3 && ptr+l <= buf+len) {
-			p+=base64decode_block(outbuf+p, ptr, l);
-			ptr += l;
-		} else {
-			break;
+		if ((wv = base64_table[(int)(unsigned char)*ptr++]) == -1) {
+			continue;
+		}
+		tmpval[tmpcnt++] = wv;
+		if (tmpcnt == 4) {
+			tmpcnt = 0;
+			w1 = tmpval[0];
+			w2 = tmpval[1];
+			w3 = tmpval[2];
+			w4 = tmpval[3];
+
+			if (w2 >= 0) {
+				outbuf[p++] = (unsigned char)(((w1 << 2) + (w2 >> 4)) & 0xFF);
+			}
+			if (w3 >= 0) {
+				outbuf[p++] = (unsigned char)(((w2 << 4) + (w3 >> 2)) & 0xFF);
+			}
+			if (w4 >= 0) {
+				outbuf[p++] = (unsigned char)(((w3 << 6) + w4) & 0xFF);
+			}
 		}
 	} while (1);
 

programming_language: C++