From 35cc35894b3dad28b6675ae1ca24383d7efadba7 Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Tue, 30 Jun 2026 15:58:36 +0200 Subject: [PATCH] libekmfweb: Fix integer overflow errors in base64 encode/decode functions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On large data sizes the calculation may cause an overflow, if done with int type. Do the calculation with size_t instead to avoid an overflow. Assisted-by: IBM Bob:2.0.0 Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- libekmfweb/ekmfweb.c | 5 +++-- libekmfweb/utilities.c | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/libekmfweb/ekmfweb.c b/libekmfweb/ekmfweb.c index 11106bd0..7d880633 100644 --- a/libekmfweb/ekmfweb.c +++ b/libekmfweb/ekmfweb.c @@ -4548,8 +4548,9 @@ out: */ static char *_ekmf_base64_encode(const unsigned char *data, size_t data_size) { - int outlen, len; + size_t outlen; char *out; + int len; outlen = (data_size / 3) * 4; if (data_size % 3 > 0) @@ -4560,7 +4561,7 @@ static char *_ekmf_base64_encode(const unsigned char *data, size_t data_size) return NULL; len = EVP_EncodeBlock((unsigned char *)out, data, data_size); - if (len != outlen) { + if (len < 0 || (size_t)len != outlen) { free(out); return NULL; } diff --git a/libekmfweb/utilities.c b/libekmfweb/utilities.c index a8cc5350..792693c6 100644 --- a/libekmfweb/utilities.c +++ b/libekmfweb/utilities.c @@ -106,7 +106,7 @@ int decode_base64url(unsigned char *output, size_t *outlen, len = EVP_DecodeBlock((unsigned char *)padded_output, (unsigned char *)padded_input, padded_inlen); - if (len != (int)padded_inlen * 3 / 4) { + if ((size_t)len != padded_inlen * 3 / 4) { rc = -EIO; goto out; }