Bug 1037683

Summary: opensc: base64 decoder assumes signed chars
Product: Red Hat Enterprise Linux 7 Reporter: Florian Weimer <fweimer>
Component: openscAssignee: Nikos Mavrogiannopoulos <nmavrogi>
Status: CLOSED NEXTRELEASE QA Contact: Release Test Team <release-test-team>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 7.0CC: atodorov, pkotvan, pvrabec
Target Milestone: rcKeywords: Rebase
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Rebase: Bug Fixes and Enhancements
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-08-26 14:37:41 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1036175    

Description Florian Weimer 2013-12-03 15:21:35 UTC
The function from_base64() in src/libopensc/base64.c assumes signed chars.  With unsigned chars, bin_table can be indexed out of bounds:

static int from_base64(const char *in, unsigned int *out, int *skip)
{
	unsigned int res = 0, c, s = 18;
	const char *in0 = in;
	
	for (c = 0; c < 4; c++, in++) {
		u8 b;
		int k = *in;
		
		if (k < 0)
			return -1;
		if (k == 0 && c == 0)
			return 0;
		b = bin_table[k];


The exact impact of this bug depends on the image layout chosen by the linker.  bin_table should end up in the text section, so no information leak is expected, and the worst that could happen is likely a crash.

Comment 4 Nikos Mavrogiannopoulos 2014-06-05 09:41:58 UTC
Created upstream pull request.
https://github.com/OpenSC/OpenSC/pull/246