From: Ralph Corderoy <ralph@inputplus.co.uk>
Date: Fri, 8 Sep 2017 13:12:51 +0000 (+0100)
Subject: base64.c: Don't out-of-bounds printf("%s", &encoded[-1]).
X-Git-Url: https://diplodocus.org/git/nmh/commitdiff_plain/1e5cdbdd102555b43fc3ffa9a45ba9e7a833c190

base64.c: Don't out-of-bounds printf("%s", &encoded[-1]).

`cp' is walking through encoded[] when an error occurs and is stepped
back up to 20 elements to provide some lead-in context for the error
message.  If might be stepped back to encoded-1, but it attempts to cope
with that by `cp ? cp : encoded'.  cp is always non-NULL so true and cp
is printed.  Presumably, `cp > encoded' was meant.  But it's all a bit
of a rigmarole so just use min() instead to ensure cp stays within
encoded and print cp.  Fixes bfc6b93af.
---

diff --git a/sbr/base64.c b/sbr/base64.c
index f24e9fe2..cbd225de 100644
--- a/sbr/base64.c
+++ b/sbr/base64.c
@@ -324,12 +324,9 @@ test_end:
     }
 
     if (! self_delimiting  &&  bitno != 18) {
-        int i;
-
         /* Show some context for the error. */
-        for (i = 0; i < 20  &&  cp > encoded; ++i, --cp) {}
-        inform("premature ending (bitno %d) near %s", bitno,
-                cp ? cp : encoded);
+        cp -= min(cp - encoded, 20);
+        inform("premature ending (bitno %d) near %s", bitno, cp);
         charstring_free (decoded_c);
         *decoded = NULL;