Array index past end of array in NSData+Base64

[newacct]

In NSData+Base64.m, in the initWithBase64EncodedString: method, the inbuf array is declared with size 3, yet it is indexed with indexes 0 thru 3, which is a buffer overflow. Curiously, the outbuf array is declared with size 4, yet is indexed with indexes 0 thru 2. Perhaps their sizes are switched.

[danielsonchris]

Found this issue as well. The code fix for this is trivial. Please also take into account that you need to memset your buffers before operating on them as well unless you want entropy laden artifacts.
unsigned char inbuf[4];
memset(&inbuf, 0x00, 4);
//while we are at it.
memset(&outbuf, 0x00, 4);

-Chris

[tanapon]

I'm also getting a warning at
outbuf [2] = ( ( inbuf[2] & 0x03 ) << 6 ) | ( inbuf[3] & 0x3F );
that says
Array index of '3' indexes past the end of an array (that contains 3 elements)
so do I have to change this > "unsigned char inbuf[3], outbuf[4];"
to this? > "unsigned char inbuf[4], outbuf[3];" or "unsigned char inbuf[4], outbuf[4];"

I have no knowledge of memset. so do I have to add memset(&inbuf, 0x00, 4); and memset(&outbuf, 0x00, 4); as well?
thanks.

[danielsonchris]

Change to: "unsigned char inbuf[4], outbuf[3];"

Memset is great for setting the buffer to a known value before you operate on that buffer. When you operate with memory in C, it should never be assumed that it is properly zero'd out or assigned to a particular set of default values. You have to do this manually and memset helps you quickly do this. Otherwise, you might have junk in your buffer. This is especially a problem if you are doing some bit flipping on that buffer without pre-assigning values to the proper offset.

From the terminal type in "man memset" You'll see more great information on it.

Kind Regards,
Chris

[newacct]

"Change to: "unsigned char inbuf[4], outbuf[4];""

Why not "unsigned char inbuf[4], outbuf[3];"?

[newacct]

Yes it is large enough. All uses of outbuf in that function are index 0, 1, or 2. Maybe you are looking at a different function. Plus the same fix was applied upstream (where this file came from) several years ago.

[danielsonchris]

Yes, I meant inbuf wasn't large enough. In the version I'm holding here it has on line 79:

outbuf [2] = ( ( inbuf[2] & 0x03 ) << 6 ) | ( inbuf[3] & 0x3F );

@newacct Just read my original post at the top.

[Jusung]

Thank you guys! @newacct and @danielsonchris you guys conversation helped me to resolve my same problem.