Skip to content

Commit dcff288

Browse files
committed
@base64d: fix unhandled overflow
$ ./jq-before -n '238609295*"|||"|@base64d|"."' src/builtin.c:718:29: runtime error: signed integer overflow: 715827885 * 3 cannot be represented in type 'int' jq: error: cannot allocate memory Aborted (core dumped) $ ./jq-after -n '238609295*"|||"|@base64d|"."' jq: error (at <unknown>): string ("||||||||||...) is not valid base64 data Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67640
1 parent be437ec commit dcff288

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

src/builtin.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -715,7 +715,7 @@ static jv f_format(jq_state *jq, jv input, jv fmt) {
715715
input = f_tostring(jq, input);
716716
const unsigned char* data = (const unsigned char*)jv_string_value(input);
717717
int len = jv_string_length_bytes(jv_copy(input));
718-
size_t decoded_len = (3 * len) / 4; // 3 usable bytes for every 4 bytes of input
718+
size_t decoded_len = (3 * (size_t)len) / 4; // 3 usable bytes for every 4 bytes of input
719719
char *result = jv_mem_calloc(decoded_len, sizeof(char));
720720
memset(result, 0, decoded_len * sizeof(char));
721721
uint32_t ri = 0;

0 commit comments

Comments
 (0)