0ct0pu5/wesnoth
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reject bad data URIs

Browse source 
(cherry-picked from commit 6444ebde60)
This commit is contained in:
Alexander van Gessel 2018-05-04 22:58:58 +02:00 • committed by Iris Morelle
parent 87c19293b7
commit 2fbd8f3334
2 changed files with 14 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/image.cpp
View file

@ -691,7 +691,9 @@ static surface load_image_data_uri(const image::locator& loc)
const std::vector<uint8_t> image_data = base64::decode(parsed.data);
filesystem::rwops_ptr rwops{SDL_RWFromConstMem(image_data.data(), image_data.size()), &SDL_FreeRW};
if(parsed.mime == "image/png") {
if(image_data.empty()) {
ERR_DP << "Invalid encoding in data URI" << std::endl;
} else if(parsed.mime == "image/png") {
surf = IMG_LoadTyped_RW(rwops.release(), true, "PNG");
} else if(parsed.mime == "image/jpeg") {
surf = IMG_LoadTyped_RW(rwops.release(), true, "JPG");

13
src/serialization/base64.cpp
View file

@ -52,7 +52,8 @@ char itoa(unsigned value, const std::string& map)
std::vector<uint8_t> generic_decode_be(utils::string_view in, const std::vector<int>& atoi_map)
{
const int last_char = in.find_last_not_of("=");
const int length = last_char * 6 / 8;
const int num_chars = last_char + 1;
const int length = num_chars * 6 / 8;
std::vector<uint8_t> out;
out.reserve(length);
@ -60,7 +61,12 @@ std::vector<uint8_t> generic_decode_be(utils::string_view in, const std::vector<
int val = 0, bits = -8;
for(unsigned char c: in) {
if(atoi_map[c] == -1) {
break; // Non-base64 character encountered. Should be =
// Non-base64 character encountered. Should be =
if(c != '='){
// If it's not a valid char, return an empty result
return {};
}
break;
}
val = (val<<6) + atoi_map[c];
bits += 6;
@ -70,6 +76,9 @@ std::vector<uint8_t> generic_decode_be(utils::string_view in, const std::vector<
val &= 0xFFFF; // Prevent shifting bits off the left end, which is UB
}
}
if(static_cast<int>(out.size()) != length) {
return {};
}
return out;
}