Bug #2370

out-of-bounds read due to signedness error

Added by stbuehler over 8 years ago. Updated over 8 years ago.

Target version:


For http auth we need to base64-decode user input; the allowed character range
includes non ASCII characters above 0x7f.

The function to decode this string takes a "const char *in"; and reads
each character into an "int ch", which is used as offset in the table.

So characters above 0x80 lead to negative indices (as char is signed on most

Here the vulnerable code (src/http_auth.c:67)

static const short base64_reverse_table[256] = ...;
static unsigned char * base64_decode(buffer *out, const char *in) {
    int ch, ...;
    size_t i;

        ch = in[i];
        ch = base64_reverse_table[ch];

It doesn't matter if "broken" data is read - it just may allow more
encodings of the correct login information.

The only possible impact is a segfault, leading to DoS.

I had a look at some debian and openSUSE binaryies, and it looks like
there is always enough data (>= 256 bytes) in the .rodata section before the
base64_reverse_table table, so these binaries are not vulnerable.

Thanks to Xi Wang who discovered the issue:
On 11/29/2011 12:42 AM, Xi Wang wrote:


There's a potential integer overflow in base64_decode() at http_auth.c:108 (lighttpd-1.4.x HEAD).

// const char *in;
// int ch;

1) ch = in[i];
2) ch = base64_reverse_table[ch];

Note that the type of in[i] is signed char. At 1) ch could be negative, and at 2) base64_reverse_table[ch] is an out-of-bounds read.

To fix it, we could change the function signature
base64_decode(buffer *out, const char *in)
base64_decode(buffer *out, const unsigned char *in)

- xi



Updated by stbuehler over 8 years ago

ch = (unsigned char) in[i]; should fix it; casting from unsigned char to int keeps the value positive (sizeof(int) > sizeof(char)).


Updated by stbuehler over 8 years ago

  • Private changed from No to Yes

Updated by stbuehler over 8 years ago

  • Project changed from internal to Lighttpd

Updated by stbuehler over 8 years ago

  • Private changed from Yes to No
  • Missing in 1.5.x set to No

Updated by stbuehler over 8 years ago

  • Status changed from New to Fixed
  • % Done changed from 0 to 100

Applied in changeset r2806.

Also available in: Atom