Off-by-one in decode

[William McCall]

libb64 has already patched this issue. It was fun chasing it down again.

From commit ID 430cbdc8c8d5cf7243fc103af680a031e44f5db0
--- a/src/cdecode.c
+++ b/src/cdecode.c
@@ -12,7 +12,7 @@
  static const char decoding[] = {62,-1,-1,-1,63,52,53,54,55,56,57,58,59,60,61,-1,-1,-1,-2,-1,-1,-1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,-1,-1,-1,-1,-1,-1,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51};
  static const char decoding_size = sizeof(decoding);
  value_in -= 43;
- if (value_in < 0 || value_in > decoding_size) return -1;
+ if (value_in < 0 || value_in >= decoding_size) return -1;
  return decoding[(int)value_in];
 }

http://sourceforge.net/p/libb64/git/ci/430cbdc8c8d5cf7243fc103af680a031e44f5db0/tree/src/cdecode.c?diff=d99a526b2a8c5592db79785b3356cde1fa0ce3c9

This is applicable to the latest and greatest packages from what I see in the repos on launchpad.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libb64 - 1.2-4

---------------
libb64 (1.2-4) unstable; urgency=medium

  * new maintainer (Closes: #706894)
  * debian/control: bump standard to 4.1.0 (no changes)
  * debian/control: use dh10
  * debian/rules: add bindnow linker flag
  * add off-by-one.diff (Closes: #801584) (LP: #1501176)

 -- Thorsten Alteholz <email address hidden> Thu, 07 Sep 2017 18:16:02 +0200