chunk: Correctly parse Base64 text where four = follow in a row

That's not correct Base64 but invalid data could trigger this. Since
outlen would get reduced four times, but is only ever increased three
times per iteration, this could result in an integer underflow and then
a potential buffer overflow.

diff --git a/src/libstrongswan/utils/chunk.c b/src/libstrongswan/utils/chunk.c
index 0c50ab788433e3e9ba642199361cd607e8f4eede..8f4b7efffa300e4a10e159afe509dfc1c74d8f84 100644 (file)
--- a/src/libstrongswan/utils/chunk.c
+++ b/src/libstrongswan/utils/chunk.c
@@ -643,7 +643,7 @@ chunk_t chunk_from_base64(chunk_t base64, char *buf)
                outlen += 3;
                for (j = 0; j < 4; j++)
                {
-                       if (*pos == '=')
+                       if (*pos == '=' && outlen > 0)
                        {
                                outlen--;
                        }