com php-src: base64_decode: reorder to fix out of bounds read: ext/standard/base64.c

Commit: c65de8ac1302a3b9825a6abe19c87fe45c68698a Author: Lauri Kenttä <lauri.kentta@gmail.com> Wed, 25 May 2016 20:28:45 +0300 Committer: Nikita Popov <nikic@php.net> Thu, 7 Jul 2016 01:27:22 +0200 Parents: ea640e611726cf0fd8b63f38f2f6c9063105ce29 Branches: PHP-7.0 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=c65de8ac1302a3b9825a6abe19c87fe45c68698a Log: base64_decode: reorder to fix out of bounds read Changed paths: M ext/standard/base64.c Diff: diff --git a/ext/standard/base64.c b/ext/standard/base64.c index 81f826c..352e7ea 100644 --- a/ext/standard/base64.c +++ b/ext/standard/base64.c @@ -143,16 +143,19 @@ PHPAPI zend_string *php_base64_decode_ex(const unsigned char *str, size_t length result = zend_string_alloc(length, 0); /* run through the whole string, converting as we go */ - while ((ch = *current++) != '\0' && length-- > 0) { + while (length-- > 0 && (ch = *current++) != '\0') { if (ch == base64_pad) { - if (*current != '=' && ((i % 4) == 1 || (strict && length > 0))) { - if ((i % 4) != 1) { - while (isspace(*(++current))) { - continue; - } - if (*current == '\0') { - continue; - } + if (i % 4 == 1) { + if (length == 0 || *current != '=') { + zend_string_free(result); + return NULL; + } + } else if (length > 0 && *current != '=' && strict) { + while (--length > 0 && isspace(*++current)) { + continue; + } + if (length == 0 || *current == '\0') { + continue; } zend_string_free(result); return NULL;