1344380 - (CVE-2017-5461) Write beyond bounds caused by bugs in Base64 de/encoding in nssb64d.c and nssb64e.c

Reporter

Description

•

8 years ago

PL_Base64MaxDecodedLength() (security\nss\lib\util\nssb64d.c) can cause an integer overflow. If it does, its caller(s) will allocate a buffer too small for the result of a Base64 decoding operation, then possibly overrun it. For example, PL_Base64DecodeBuffer() (security\nss\lib\util\nssb64d.c) uses the result of PL_Base64MaxDecodedLength() to check whether a caller-provided buffer is long enough, or to allocate a buffer if the caller does not provide one. In either case, the calculated length is inadequate if the length of the encoded string is >= 0x55555556. Once it has calculated the (potentially incorrect) length, it passes it and the corresponding buffer to pl_base64_decode_buffer() (same module) to do the decoding. That function incrementally checks against the provided length (data->output_buflen) but (another bug!) *only in debug builds (i.e. via a PR_ASSERT())*. The upshot is that PL_Base64DecodeBuffer() might be vulnerable to the same kind of buffer overrun bug as in https://bugzilla.mozilla.org/show_bug.cgi?id=1344081 : an attack that overruns a heap buffer, by an attacker-determined amount, with 3-byte granularity. There is a similar issue in PL_Base64MaxEncodedLength() and its associated functions for Base64 encoding. I will try to manifest these bugs and post a POC if and when I do. The bugs are in lines 373 and 254 (nssb64d.c): 370: static PRUint32 371: PL_Base64MaxDecodedLength (PRUint32 size) 372: { 373: return ((size * 3) / 4); 374: } 219: static PRStatus 220: pl_base64_decode_buffer (PLBase64Decoder *data, const unsigned char *in, 221: PRUint32 length) 222: { 223: unsigned char *out = data->output_buffer; 224: unsigned char *token = data->token; 225: int i, n = 0; 226: 227: i = data->token_size; 228: data->token_size = 0; 229: 230: while (length > 0) { 231: while (i < 4 && length > 0) { ... 254: PR_ASSERT((out - data->output_buffer + 3) <= data->output_buflen); and 288 and potentially 300 (nssb64e.c): 280: static PRUint32 281: PL_Base64MaxEncodedLength (PRUint32 size, PRUint32 line_length) 282: { 283: PRUint32 tokens, tokens_per_line, full_lines, line_break_chars, remainder; 284: 285: tokens = (size + 2) / 3; 286: 287: if (line_length == 0) 288: return tokens * 4; 289: 290: if (line_length < 4) /* too small! */ 291: line_length = 4; 292: 293: tokens_per_line = line_length / 4; 294: full_lines = tokens / tokens_per_line; 295: remainder = (tokens - (full_lines * tokens_per_line)) * 4; 296: line_break_chars = full_lines * 2; 297: if (remainder == 0) 298: line_break_chars -= 2; 299: 300: return (full_lines * tokens_per_line * 4) + line_break_chars + remainder; 301: }

q1

Reporter