Tobias Frauenschläger d4755b4b62 Fix EVP_DecodeUpdate overflow on NUL byte in base64 input ...

The quad decoding loop broke out on a NUL byte without clearing the
remaining input length, unlike the equivalent loops in Base64_Decode and
Base64_Decode_nonCT. Control then fell into the block that buffers the
leftover input in the context, which copied the full remaining byte count
into the 48 byte ctx->data with an unbounded index, and read one byte past
the end of the caller's buffer. An application decoding attacker supplied
base64 with an explicit, binary safe length could write attacker
controlled data past the end of a heap allocated encode context.

Clear the length before breaking, and bound the leftover copy loop at one
decode block, which is the most that loop can legitimately buffer. That
also keeps ctx->remaining below the block size, so a reused context cannot
underflow the copy size in the next update call or over-read ctx->data in
EVP_DecodeFinal.

Add a negative test feeding a NUL byte followed by more non-whitespace
data than the context buffer can hold.

Fixes F-7445.

2026-08-07 08:11:23 +02:00

..

benchmark

wolfcrypt/src/falcon.c, configure.ac, wolfcrypt/benchmark/benchmark.c, wolfcrypt/test/test.h, wolfcrypt/test/test.c: Falcon fixes and cleanups:

2026-08-05 13:53:46 -05:00

src

Fix EVP_DecodeUpdate overflow on NUL byte in base64 input

2026-08-07 08:11:23 +02:00

test

linuxkm/linuxkm_wc_port.h, linuxkm/x86_vector_register_glue.c, wolfcrypt/test/test.c: implement DEBUG_VECTOR_REGISTER_ACCESS_ALWAYS_{ON,OFF}, to allow forcing of asm and C paths for kernel module testing.

2026-08-06 18:20:30 -05:00