Fix memory allocation bug in base64_encode

pguyot · pguyot · commit f5377cb16ec5 · 2023-04-19T08:10:16.000+02:00
This bug currently cannot yield a crash because the miscalculation is preceded
by an allocation which includes the MIN_FREE_SPACE_SIZE margin, larger than
padding.

Signed-off-by: Paul Guyot &lt;pguyot@kallisys.net&gt;
diff --git a/src/libAtomVM/nifs.c b/src/libAtomVM/nifs.c
@@ -3229,7 +3229,7 @@ static term base64_encode(Context *ctx, int argc, term argv[], bool return_binar
     size_t dst_size_with_pad = dst_size + pad;
     size_t heap_free = return_binary ?
         term_binary_data_size_in_terms(dst_size_with_pad) + BINARY_HEADER_SIZE
-        : 2*dst_size;
+        : 2*dst_size_with_pad;
     if (UNLIKELY(memory_ensure_free(ctx, heap_free) != MEMORY_GC_OK)) {
         RAISE_ERROR(OUT_OF_MEMORY_ATOM);
     }

Original file line number	Diff line number	Diff line change
`@@ -3229,7 +3229,7 @@ static term base64_encode(Context *ctx, int argc, term argv[], bool return_binar`
`3229`	`3229`	`size_t dst_size_with_pad = dst_size + pad;`
`3230`	`3230`	`size_t heap_free = return_binary ?`
`3231`	`3231`	`term_binary_data_size_in_terms(dst_size_with_pad) + BINARY_HEADER_SIZE`
`3232`		`- : 2*dst_size;`
	`3232`	`+ : 2*dst_size_with_pad;`
`3233`	`3233`	`if (UNLIKELY(memory_ensure_free(ctx, heap_free) != MEMORY_GC_OK)) {`
`3234`	`3234`	`RAISE_ERROR(OUT_OF_MEMORY_ATOM);`
`3235`	`3235`	`}`