lib/coreutils
1
0
Fork 0
mirror of https://git.savannah.gnu.org/git/coreutils.git synced 2026-10-24 02:08:57 +03:00
Code Activity

basenc: fix incorrect base32hex input validation

Browse Source 
* src/basenc.c (base32hex_decode_ctx_wrapper): Ensure we don't
accept base32 only characters for base32hex.
* tests/basenc/basenc.pl: Ensure negative base32hex tests have the
appropriate number of characters to test character validation
rather than just input size validation.
* NEWS: Mention the bug fix.

Discovered by Anthropic's OSS Scanner, as bug ANT-2026-EP1XO2G4.
This commit is contained in:
Pádraig Brady
2026-10-22 13:25:39 +01:00
parent 71a480bafa
commit 4c4f2f55c3
3 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
NEWS
View File

@@ -4,6 +4,9 @@ GNU coreutils NEWS -*- outline -*-
** Bug fixes
'basenc --base32hex' no longer decodes BASE32 only characters "WXYZ".
[bug introduced with the basenc program in coreutils-8.31]
'chroot --userspec=USER' now uses the primary group of USER as looked up
inside the chroot. Previously the group looked up outside the chroot
was used, even when the look-up inside the chroot succeeded.

2
src/basenc.c
View File

@@ -645,6 +645,8 @@ base32hex_decode_ctx_wrapper (struct base_decode_context *ctx,
{
if (isubase32hex (*in))
*p = base32_hex_to_norm[*in - 0x30];
else if (isubase32 (*in))
*p = '0'; /* Ensure base32 rejects non hex variant. */
else
*p = *in;
++p;

4
tests/basenc/basenc.pl
View File

@@ -166,9 +166,9 @@ my @Tests =
['b32h_2', '--base32hex -d', {IN=>$base32hex_out}, {OUT=>$base32_in}],
['b32h_3', '--base32hex -d -i', {IN=>'/'.$base32hex_out}, {OUT=>$base32_in}],
['b32h_4', '--base32hex -d -i', {IN=>'W'.$base32hex_out}, {OUT=>$base32_in}],
['b32h_5', '--base32hex -d', {IN=>$base32hex_out.'W'}, , {OUT=>$base32_in},
['b32h_5', '--base32hex -d', {IN=>$base32hex_out.'WXYZW'},{OUT=>$base32_in},
{EXIT=>1}, {ERR=>"$prog: invalid input\n"}],
['b32h_6', '--base32hex -d', {IN=>$base32hex_out.'/'}, {OUT=>$base32_in},
['b32h_6', '--base32hex -d', {IN=>$base32hex_out.'/////'},{OUT=>$base32_in},
{EXIT=>1}, {ERR=>"$prog: invalid input\n"}],
['b32h_7', '--base32hex', {IN=>$base32_in2}, {OUT=>$base32hex_out2}],
['b32h_8', '--base32hex -d', {IN=>$base32hex_out2}, {OUT=>$base32_in2}],