[base64] Avoid overrunning input data buffer

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/core/base64.c b/src/core/base64.c
index 7514c1faceca69b42cb5b9cfa201d928080c7696..761b42f27061b3b5d284131715baca308a617f9b 100644 (file)
--- a/src/core/base64.c
+++ b/src/core/base64.c
@@ -54,11 +54,16 @@ void base64_encode ( const uint8_t *raw, size_t len, char *encoded ) {
        uint8_t *encoded_bytes = ( ( uint8_t * ) encoded );
        size_t raw_bit_len = ( 8 * len );
        unsigned int bit;
+       unsigned int byte;
+       unsigned int shift;
        unsigned int tmp;
 
        for ( bit = 0 ; bit < raw_bit_len ; bit += 6 ) {
-               tmp = ( ( raw_bytes[ bit / 8 ] << ( bit % 8 ) ) |
-                       ( raw_bytes[ bit / 8 + 1 ] >> ( 8 - ( bit % 8 ) ) ) );
+               byte = ( bit / 8 );
+               shift = ( bit % 8 );
+               tmp = ( raw_bytes[byte] << shift );
+               if ( ( byte + 1 ) < len )
+                       tmp |= ( raw_bytes[ byte + 1 ] >> ( 8 - shift ) );
                tmp = ( ( tmp >> 2 ) & 0x3f );
                *(encoded_bytes++) = base64[tmp];
        }