[Bug 224141] possible Off-by-one bug in the Base64 decoding in the wpa supplicant

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=224141

            Bug ID: 224141
           Summary: possible Off-by-one bug in the Base64 decoding in the
                    wpa supplicant
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: wireless
          Assignee: freebsd-wireless at FreeBSD.org
          Reporter: ikostov at gmail.com

Hi guys,

I think there is an issue with the base64 decode function:

from http://web.mit.edu/freebsd/head/contrib/wpa/src/utils/base64.c

unsigned char * base64_decode(const unsigned char *src, size_t len,
                              size_t *out_len)
{
......
        for (i = 0; i < sizeof(base64_table) - 1; i++)
                dtable[base64_table[i]] = (unsigned char) i;
.....

the problem is the for loop which initializes the dtable. It does not
initialize the last element from the table ('/') which causes the char to be
interpreted as a garbage and ignored. Please have a closer look.

Best regards,
Ivan

-- 
You are receiving this mail because:
You are the assignee for the bug.