Commit 18ec5ff4 authored by wyykak's avatar wyykak Committed by GitHub

fix potential buffer overflow in deck code import/export module (#61)

parent f7adf1a9
......@@ -2,6 +2,7 @@
#define BASE64_H
#include <string>
#include <cstring>
const char kBase64Alphabet[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
"abcdefghijklmnopqrstuvwxyz"
......@@ -60,8 +61,10 @@ class Base64 {
size_t encoded_length = EncodedLength(input_length);
if (out_length < encoded_length) return false;
if (out_length < encoded_length + 1) return false;
std::memset(out, 0, out_length);
while (input_length--) {
a3[i++] = *input++;
if (i == 3) {
......
......@@ -322,7 +322,7 @@ int DeckManager::TypeCount(std::vector<code_pointer> list, unsigned int ctype) {
bool DeckManager::LoadDeckFromCode(Deck& deck, const char *code, int len) {
char data[1024], *pdeck = data, *data_ = data;
int decoded_len = Base64::DecodedLength(code, len);
if(decoded_len < 8 || !Base64::Decode(code, len, data_, decoded_len))
if(decoded_len > 1024 || decoded_len < 8 || !Base64::Decode(code, len, data_, decoded_len))
return false;
int mainc = BufferIO::ReadInt32(pdeck);
int sidec = BufferIO::ReadInt32(pdeck);
......@@ -341,7 +341,7 @@ int DeckManager::SaveDeckToCode(Deck& deck, char* code) {
BufferIO::WriteInt32(pdeck, deck.side[i]->first);
int len = pdeck - deckbuf;
int encoded_len = Base64::EncodedLength(len);
Base64::Encode(deckbuf, len, code, encoded_len);
Base64::Encode(deckbuf, len, code, encoded_len+1);
return encoded_len;
}
bool DeckManager::CreateCategory(const wchar_t* name) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment