Re: [PATCH] netmgr: avoid out-of-bounds read from sign-extended char in DoH base64url decoder
Ondřej Surý <[email protected]> Thu, 2 Jul 2026 07:22:56 +0200
| Newsgroups | gmane.network.dns.bind.user |
|---|---|
| Message-ID | <[email protected]> |
SW4gYW55IGNhc2UsIHRoZSBiaW5kLXVzZXJzIGlzIGEgd3JvbmcgcGxhY2UgdG8gcmVwb3J0IGJ1 Z3MgbGlrZSB0aGlzLiBJIHdvdWxkIGFzayB0aGUgT1AgdG8gcmVwb3J0IHRoaXMgYXMgYW4gaXNz dWUgaW4gb3VyIEdpdExhYiwgc28gaXQgZG9lcyBub3QgZ2V0IGxvc3QuIEFsc28gdGhlIEdMIGhh cyB0aGUgdGVtcGxhdGUgdGhhdCBhc2tzIGFsbCB0aGUgcXVlc3Rpb25zIG5lZWRlZCB0byBwcm9w ZXJseSBkaWFnbm9zZSB0aGUgaXNzdWUuCgpPbmRyZWoKLS0KT25kxZllaiBTdXLDvSAoSGUvSGlt KQpvbmRyZWpAaXNjLm9yZwoKQURIRCBicmFpbiBhdCB3b3JrOiBJIHNvbWV0aW1lcyBsb3NlIHRy YWNrIG9mIG15IGluYm94LiBQbGVhc2UgZmVlbCBmcmVlIHRvIHNlbmQgYSBnZW50bGUgbnVkZ2Ug aWYgeW91J3JlIHdhaXRpbmcgb24gYSByZXBseSEKCk15IHdvcmtpbmcgaG91cnMgYW5kIHlvdXIg d29ya2luZyBob3VycyBtYXkgYmUgZGlmZmVyZW50LiBQbGVhc2UgZG8gbm90IGZlZWwgb2JsaWdh dGVkIHRvIHJlcGx5IG91dHNpZGUgeW91ciBub3JtYWwgd29ya2luZyBob3Vycy4KCj4gT24gMS4g Ny4gMjAyNiwgYXQgMjE6MjEsIERvdWcgRnJlZWQgPGR3ZnJlZWRAaXNjLm9yZz4gd3JvdGU6Cj4g Cj4g77u/T24gNy8xLzI2IDA4OjI3LCBJc21haWwgUmFtemkgd3JvdGU6Cj4+IGlzY19fbm1fYmFz ZTY0dXJsX3RvX2Jhc2U2NCgpIGFuZCBpc2NfX25tX2Jhc2U2NF90b19iYXNlNjR1cmwoKSBpbgo+ PiBsaWIvaXNjL25ldG1nci9odHRwLmMgaW5kZXggdGhlIDI1Ni1lbnRyeSBiYXNlNjR1cmxfdmFs aWRhdGlvbl90YWJsZVtdCj4+IHdpdGggYSBwbGFpbiBjaGFyIGNhc3Qgc3RyYWlnaHQgdG8gc2l6 ZV90Ogo+PiAgICBiYXNlNjR1cmxfdmFsaWRhdGlvbl90YWJsZVsoc2l6ZV90KWJhc2U2NHVybFtp XV0KPj4gY2hhciBpcyBzaWduZWQgb24gdGhlIHBsYXRmb3JtcyBCSU5EIGNvbW1vbmx5IHJ1bnMg b24gKHg4Ni02NCwgYXJtNjQpLAo+PiBzbyBhbnkgaW5wdXQgYnl0ZSB3aXRoIHRoZSBoaWdoIGJp dCBzZXQgKDB4ODAtMHhGRikgaXMgc2lnbi1leHRlbmRlZAo+PiBiZWZvcmUgdGhlIGNvbnZlcnNp b24gdG8gc2l6ZV90LiAgRm9yIGV4YW1wbGUgKHNpemVfdCkoY2hhcikweDgwIGlzCj4+IDB4ZmZm ZmZmZmZmZmZmZmY4MCwgd2hpY2ggaXMgdXNlZCBhcyBhbiBpbmRleCBpbnRvIGEgMjU2LWVsZW1l bnQgYXJyYXksCj4+IGkuZS4gYSB3aWxkIG91dC1vZi1ib3VuZHMgcmVhZC4gIERlcGVuZGluZyBv biB3aGF0IHRoZSByZWFkIHJldHVybnMgdGhlCj4+IGJ5dGUgaXMgZWl0aGVyIGFjY2VwdGVkIChh bmQgY29waWVkIGludG8gdGhlIGZyZXNobHkgYWxsb2NhdGVkIG91dHB1dCwKPj4gcHJvZHVjaW5n IGNvcnJ1cHQgZGF0YSBhbmQgYSBsZWFrKSBvciB0aGUgcHJvY2VzcyByZWFkcyB1bm1hcHBlZCBt ZW1vcnkKPj4gYW5kIGNyYXNoZXMuCj4+IFRoZXNlIGFyZSB0aGUgZGVjb2RlcnMgdXNlZCB0byB0 dXJuIHRoZSBiYXNlNjR1cmwgIj9kbnM9IiBwYXJhbWV0ZXIgb2YgYQo+PiBEb0ggR0VUIHJlcXVl c3QgaW50byBiYXNlNjQsIHNvIHRoZXkgYXJlIG1lYW50IHRvIG9wZXJhdGUgb24KPj4gYXR0YWNr ZXItc3VwcGxpZWQgYnl0ZXMuICBUaGUgZml4IGJlbG9uZ3MgaW4gdGhlIGRlY29kZXJzIHRoZW1z ZWx2ZXMgYW5kCj4+IG5vdCBpbiB0aGUgY2FsbGVyczogY2FzdCBlYWNoIGJ5dGUgdG8gdW5zaWdu ZWQgY2hhciBiZWZvcmUgdXNpbmcgaXQgYXMKPj4gYW4gaW5kZXgsIHdoaWNoIGlzIHRoZSBjb252 ZW50aW9uIGFscmVhZHkgdXNlZCBlbHNld2hlcmUgaW4gdGhlIHRyZWUKPj4gKGUuZy4gbGliL2lz Yy9odHRwZC5jKS4gIEFuIHVuc2lnbmVkIGNoYXIgaXMgYWx3YXlzIGEgdmFsaWQgaW5kZXggaW50 bwo+PiB0aGUgMjU2LWVudHJ5IHRhYmxlLCBzbyB0aGUgZXh0cmEgc2l6ZV90IGNhc3QgaXMgbm8g bG9uZ2VyIG5lZWRlZC4KPj4gQSByZWdyZXNzaW9uIGNhc2UgaXMgYWRkZWQgdG8gdGhlIGRvaF9i YXNlNjR1cmxfdG9fYmFzZTY0IHVuaXQgdGVzdCB0aGF0Cj4+IGZlZWRzIGEgYnl0ZSB3aXRoIHRo ZSBoaWdoIGJpdCBzZXQ7IGJlZm9yZSB0aGUgZml4IGl0IHJlYWRzIG91dCBvZgo+PiBib3VuZHMg KGFuZCB3cm9uZ2x5IHJldHVybnMgYSBub24tTlVMTCByZXN1bHQpLCBhZnRlciB0aGUgZml4IHRo ZSBieXRlCj4+IGlzIHJlamVjdGVkIGFuZCBOVUxMIGlzIHJldHVybmVkLgo+PiAtLS0KPj4gZGlm ZiAtLWdpdCBhL2xpYi9pc2MvbmV0bWdyL2h0dHAuYyBiL2xpYi9pc2MvbmV0bWdyL2h0dHAuYwo+ PiBpbmRleCA4ZjZjZjIxLi4wNjNhYTEwIDEwMDY0NAo+PiAtLS0gYS9saWIvaXNjL25ldG1nci9o dHRwLmMKPj4gKysrIGIvbGliL2lzYy9uZXRtZ3IvaHR0cC5jCj4+IEBAIC0zNTI5LDcgKzM1Mjks OSBAQCBpc2NfX25tX2Jhc2U2NHVybF90b19iYXNlNjQoaXNjX21lbV90ICptZW0sIGNvbnN0IGNo YXIgKmJhc2U2NHVybCwKPj4gICAgICAgICAgICAgIHJlc1tpXSA9ICcvJzsKPj4gICAgICAgICAg ICAgIGJyZWFrOwo+PiAgICAgICAgICBkZWZhdWx0Ogo+PiAtICAgICAgICAgICAgaWYgKGJhc2U2 NHVybF92YWxpZGF0aW9uX3RhYmxlWyhzaXplX3QpYmFzZTY0dXJsW2ldXSkgewo+PiArICAgICAg ICAgICAgaWYgKGJhc2U2NHVybF92YWxpZGF0aW9uX3RhYmxlWyh1bnNpZ25lZCBjaGFyKQo+PiAr ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBiYXNlNjR1cmxbaV1dKQo+PiArICAg ICAgICAgICAgewo+PiAgICAgICAgICAgICAgICAgIHJlc1tpXSA9IGJhc2U2NHVybFtpXTsKPj4g ICAgICAgICAgICAgIH0gZWxzZSB7Cj4+ICAgICAgICAgICAgICAgICAgaXNjX21lbV9mcmVlKG1l bSwgcmVzKTsKPj4gQEAgLTM1ODcsNyArMzU4OSw3IEBAIGlzY19fbm1fYmFzZTY0X3RvX2Jhc2U2 NHVybChpc2NfbWVtX3QgKm1lbSwgY29uc3QgY2hhciAqYmFzZTY0LAo+PiAgICAgICAgICAgICAg ICogdGhlIHJlc3Qgb2YgdGhlIGNoYXJhY3RlcnMuCj4+ICAgICAgICAgICAgICAgKi8KPj4gICAg ICAgICAgICAgIGlmIChiYXNlNjRbaV0gIT0gJy0nICYmIGJhc2U2NFtpXSAhPSAnXycgJiYKPj4g LSAgICAgICAgICAgICAgICBiYXNlNjR1cmxfdmFsaWRhdGlvbl90YWJsZVsoc2l6ZV90KWJhc2U2 NFtpXV0pCj4+ICsgICAgICAgICAgICAgICAgYmFzZTY0dXJsX3ZhbGlkYXRpb25fdGFibGVbKHVu c2lnbmVkIGNoYXIpYmFzZTY0W2ldXSkKPj4gICAgICAgICAgICAgIHsKPj4gICAgICAgICAgICAg ICAgICByZXNbaV0gPSBiYXNlNjRbaV07Cj4+ICAgICAgICAgICAgICB9IGVsc2Ugewo+PiBkaWZm IC0tZ2l0IGEvdGVzdHMvaXNjL2RvaF90ZXN0LmMgYi90ZXN0cy9pc2MvZG9oX3Rlc3QuYwo+PiBp bmRleCBmYTVjOWNiLi5jMDYzN2Q5IDEwMDY0NAo+PiAtLS0gYS90ZXN0cy9pc2MvZG9oX3Rlc3Qu Ywo+PiArKysgYi90ZXN0cy9pc2MvZG9oX3Rlc3QuYwo+PiBAQCAtMTQ4NCw2ICsxNDg0LDE5IEBA IElTQ19SVU5fVEVTVF9JTVBMKGRvaF9iYXNlNjR1cmxfdG9fYmFzZTY0KSB7Cj4+ICAgICAgICAg IGFzc2VydF9udWxsKHJlcyk7Cj4+ICAgICAgICAgIGFzc2VydF90cnVlKHJlc19sZW4gPT0gMCk7 Cj4+ICAgICAgfQo+PiArICAgIC8qCj4+ICsgICAgICogaW52YWxpZDogYSBieXRlIHdpdGggdGhl IGhpZ2ggYml0IHNldCBtdXN0IGJlIHJlamVjdGVkIGFuZCBtdXN0Cj4+ICsgICAgICogbm90IGJl IHVzZWQgYXMgYSAoc2lnbi1leHRlbmRlZCkgaW5kZXggaW50byB0aGUgdmFsaWRhdGlvbiB0YWJs ZS4KPj4gKyAgICAgKi8KPj4gKyAgICB7Cj4+ICsgICAgICAgIGNoYXIgdGVzdFtdID0geyAnUCcs ICdEJywgJ3cnLCAoY2hhcikweDgwLCAnXDAnIH07Cj4+ICsgICAgICAgIHJlc19sZW4gPSAwOwo+ PiArCj4+ICsgICAgICAgIHJlcyA9IGlzY19fbm1fYmFzZTY0dXJsX3RvX2Jhc2U2NChpc2NfZ19t Y3R4LCB0ZXN0LAo+PiArICAgICAgICAgICAgICAgICAgICAgICAgICBzdHJsZW4odGVzdCksICZy ZXNfbGVuKTsKPj4gKyAgICAgICAgYXNzZXJ0X251bGwocmVzKTsKPj4gKyAgICAgICAgYXNzZXJ0 X3RydWUocmVzX2xlbiA9PSAwKTsKPj4gKyAgICB9Cj4+ICB9Cj4+ICAgIElTQ19SVU5fVEVTVF9J TVBMKGRvaF9iYXNlNjRfdG9fYmFzZTY0dXJsKSB7Cj4gCj4gTm90ZSB0aGF0IGl0J3Mgbm90IHBv c3NpYmxlIHRvIHJlYWNoIHRoaXMgY29kZSB3aXRoIGEgRG9IIGRucyBwYXJhbWV0ZXIgdmFsdWUg Y29udGFpbmluZyBhbnkgY2hhcmFjdGVyIGdyZWF0ZXIgdGhhbiAweDdGIGF0IHByZXNlbnQsIGFz IHRoZSBwYXJzZXIgdXNlZCB0byBleHRyYWN0IHRoZSB2YWx1ZSBiZWZvcmUgY2FsbGluZyB0aGlz IGNvZGUgaXMgZXh0cmVtZWx5IHN0cmljdCBhbmQgd2lsbCByZWplY3QgdGhlIHF1ZXJ5LiAgVGhl cmUgaXMgbm8gb3RoZXIgdXNlIG9mIHRoaXMgY29kZSBhcyBvZiB0aGlzIHdyaXRpbmcuCj4gCj4g V2hpbGUgdGhlIHNpZ25lZCBpc3N1ZSBoZXJlIHNob3VsZCBiZSBmaXhlZCBpbiBteSBwZXJzb25h bCBvcGluaW9uLCB0aGlzIGlzc3VlIGlzIHB1cmVseSB0aGVvcmV0aWNhbCBhdCB0aGlzIHBvaW50 Lgo+IAo+IC1Eb3VnCj4gLS0KPiBWaXNpdCBodHRwczovL2xpc3RzLmlzYy5vcmcvbWFpbG1hbi9s aXN0aW5mby9iaW5kLXVzZXJzIHRvIHVuc3Vic2NyaWJlIGZyb20gdGhpcyBsaXN0LgoKLS0gClZp c2l0IGh0dHBzOi8vbGlzdHMuaXNjLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2JpbmQtdXNlcnMgdG8g dW5zdWJzY3JpYmUgZnJvbSB0aGlzIGxpc3QuCg==