From 3cdd1e94b1d71f2ce3002738f9506da91fe2af45 Mon Sep 17 00:00:00 2001 From: Emilia Kasper Date: Wed, 2 Sep 2015 15:31:28 +0200 Subject: RT3757: base64 encoding bugs Rewrite EVP_DecodeUpdate. In particular: reject extra trailing padding, and padding in the middle of the content. Don't limit line length. Add tests. Previously, the behaviour was ill-defined, and depended on the position of the padding within the input. In addition, this appears to fix a possible two-byte oob read. Reviewed-by: Richard Levitte Reviewed-by: Rich Salz Reviewed-by: Dr Stephen Henson --- CHANGES | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'CHANGES') diff --git a/CHANGES b/CHANGES index a7dab6cd12..3aa9dc813b 100644 --- a/CHANGES +++ b/CHANGES @@ -4,6 +4,12 @@ Changes between 1.0.2 and 1.1.0 [xx XXX xxxx] + *) Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs. + This changes the decoding behaviour for some invalid messages, + though the change is mostly in the more lenient direction, and + legacy behaviour is preserved as much as possible. + [Emilia Käsper] + *) New testing framework The testing framework has been largely rewritten and is now using perl and the perl modules Test::Harness and an extended variant of -- cgit v1.2.3