Turbo-Base64 icon indicating copy to clipboard operation
Turbo-Base64 copied to clipboard

Undefined Behavior (caught by ASAN)

Open DUOLabs333 opened this issue 1 year ago • 0 comments

I've been using this library for a while in a project of mine, and it's been working perfectly for me. However, recently, I pushed an update that broke in very specific scenarios. After debugging for ~3 hours, I was able to trace it to this library: as it turns out, tb64enc reads in past inlen, and writes to out past tb64enclen(inlen). An MRE is given below (compile this and the library with -fsanitize=address):

#include <turbob64.h>
#include <string.h>
#include <stdio.h>
int main(){

	auto buf = new char[128]; //For there to be no error, this needs to be at least 132

	auto data = new char[94]; //For there to be no error, this needs to be at least 97

	memset(data, 0, 94);

	for(int i=0; i< 128; i++){
			printf("Length: %zu\n", tb64enclen(94));
			tb64enc((unsigned char*)data, 94, (unsigned char*)buf);
	}

}

DUOLabs333 avatar Sep 25 '24 01:09 DUOLabs333