mirror of
https://github.com/transmission/transmission.git
synced 2025-12-20 02:18:42 +00:00
Reserve a few more bytes for base64 operations to prevent heap corruption
This commit is contained in:
@@ -208,7 +208,7 @@ tr_base64_encode (const void * input,
|
|||||||
ret_length += ret_length / 72 + 1;
|
ret_length += ret_length / 72 + 1;
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
ret = tr_new (char, ret_length + 1);
|
ret = tr_new (char, ret_length + 8);
|
||||||
|
|
||||||
base64_init_encodestate (&state);
|
base64_init_encodestate (&state);
|
||||||
ret_length = base64_encode_block (input, input_length, ret, &state);
|
ret_length = base64_encode_block (input, input_length, ret, &state);
|
||||||
@@ -256,7 +256,7 @@ tr_base64_decode (const void * input,
|
|||||||
size_t ret_length = input_length / 4 * 3;
|
size_t ret_length = input_length / 4 * 3;
|
||||||
base64_decodestate state;
|
base64_decodestate state;
|
||||||
|
|
||||||
ret = tr_new (char, ret_length + 1);
|
ret = tr_new (char, ret_length + 8);
|
||||||
|
|
||||||
base64_init_decodestate (&state);
|
base64_init_decodestate (&state);
|
||||||
ret_length = base64_decode_block (input, input_length, ret, &state);
|
ret_length = base64_decode_block (input, input_length, ret, &state);
|
||||||
|
|||||||
Reference in New Issue
Block a user