1/***************************************************************************
2 * _ _ ____ _
3 * Project ___| | | | _ \| |
4 * / __| | | | |_) | |
5 * | (__| |_| | _ <| |___
6 * \___|\___/|_| \_\_____|
7 *
8 * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
9 *
10 * This software is licensed as described in the file COPYING, which
11 * you should have received as part of this distribution. The terms
12 * are also available at https://curl.se/docs/copyright.html.
13 *
14 * You may opt to use, copy, modify, merge, publish, distribute and/or sell
15 * copies of the Software, and permit persons to whom the Software is
16 * furnished to do so, under the terms of the COPYING file.
17 *
18 * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
19 * KIND, either express or implied.
20 *
21 * SPDX-License-Identifier: curl
22 *
23 ***************************************************************************/
24
25/* Base64 encoding/decoding */
26
27#include "curl_setup.h"
28
29#if !defined(CURL_DISABLE_HTTP_AUTH) || defined(USE_SSH) || \
30 !defined(CURL_DISABLE_LDAP) || \
31 !defined(CURL_DISABLE_SMTP) || \
32 !defined(CURL_DISABLE_POP3) || \
33 !defined(CURL_DISABLE_IMAP) || \
34 !defined(CURL_DISABLE_DOH) || defined(USE_SSL) || defined(BUILDING_CURL)
35#include "curl/curl.h"
36#include "warnless.h"
37#include "curl_base64.h"
38
39/* The last 2 #include files should be in this order */
40#ifdef BUILDING_LIBCURL
41#include "curl_memory.h"
42#endif
43#include "memdebug.h"
44
45/* ---- Base64 Encoding/Decoding Table --- */
46/* Padding character string starts at offset 64. */
47static const char base64encdec[]=
48 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";
49
50/* The Base 64 encoding with a URL and filename safe alphabet, RFC 4648
51 section 5 */
52static const char base64url[]=
53 "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
54
55static const unsigned char decodetable[] =
56{ 62, 255, 255, 255, 63, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 255, 255, 255,
57 255, 255, 255, 255, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16,
58 17, 18, 19, 20, 21, 22, 23, 24, 25, 255, 255, 255, 255, 255, 255, 26, 27, 28,
59 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47,
60 48, 49, 50, 51 };
61/*
62 * Curl_base64_decode()
63 *
64 * Given a base64 NUL-terminated string at src, decode it and return a
65 * pointer in *outptr to a newly allocated memory area holding decoded
66 * data. Size of decoded data is returned in variable pointed by outlen.
67 *
68 * Returns CURLE_OK on success, otherwise specific error code. Function
69 * output shall not be considered valid unless CURLE_OK is returned.
70 *
71 * When decoded data length is 0, returns NULL in *outptr.
72 *
73 * @unittest: 1302
74 */
75CURLcode Curl_base64_decode(const char *src,
76 unsigned char **outptr, size_t *outlen)
77{
78 size_t srclen = 0;
79 size_t padding = 0;
80 size_t i;
81 size_t numQuantums;
82 size_t fullQuantums;
83 size_t rawlen = 0;
84 unsigned char *pos;
85 unsigned char *newstr;
86 unsigned char lookup[256];
87
88 *outptr = NULL;
89 *outlen = 0;
90 srclen = strlen(s: src);
91
92 /* Check the length of the input string is valid */
93 if(!srclen || srclen % 4)
94 return CURLE_BAD_CONTENT_ENCODING;
95
96 /* srclen is at least 4 here */
97 while(src[srclen - 1 - padding] == '=') {
98 /* count padding characters */
99 padding++;
100 /* A maximum of two = padding characters is allowed */
101 if(padding > 2)
102 return CURLE_BAD_CONTENT_ENCODING;
103 }
104
105 /* Calculate the number of quantums */
106 numQuantums = srclen / 4;
107 fullQuantums = numQuantums - (padding ? 1 : 0);
108
109 /* Calculate the size of the decoded string */
110 rawlen = (numQuantums * 3) - padding;
111
112 /* Allocate our buffer including room for a null-terminator */
113 newstr = malloc(rawlen + 1);
114 if(!newstr)
115 return CURLE_OUT_OF_MEMORY;
116
117 pos = newstr;
118
119 memset(s: lookup, c: 0xff, n: sizeof(lookup));
120 memcpy(dest: &lookup['+'], src: decodetable, n: sizeof(decodetable));
121 /* replaces
122 {
123 unsigned char c;
124 const unsigned char *p = (const unsigned char *)base64encdec;
125 for(c = 0; *p; c++, p++)
126 lookup[*p] = c;
127 }
128 */
129
130 /* Decode the complete quantums first */
131 for(i = 0; i < fullQuantums; i++) {
132 unsigned char val;
133 unsigned int x = 0;
134 int j;
135
136 for(j = 0; j < 4; j++) {
137 val = lookup[(unsigned char)*src++];
138 if(val == 0xff) /* bad symbol */
139 goto bad;
140 x = (x << 6) | val;
141 }
142 pos[2] = x & 0xff;
143 pos[1] = (x >> 8) & 0xff;
144 pos[0] = (x >> 16) & 0xff;
145 pos += 3;
146 }
147 if(padding) {
148 /* this means either 8 or 16 bits output */
149 unsigned char val;
150 unsigned int x = 0;
151 int j;
152 size_t padc = 0;
153 for(j = 0; j < 4; j++) {
154 if(*src == '=') {
155 x <<= 6;
156 src++;
157 if(++padc > padding)
158 /* this is a badly placed '=' symbol! */
159 goto bad;
160 }
161 else {
162 val = lookup[(unsigned char)*src++];
163 if(val == 0xff) /* bad symbol */
164 goto bad;
165 x = (x << 6) | val;
166 }
167 }
168 if(padding == 1)
169 pos[1] = (x >> 8) & 0xff;
170 pos[0] = (x >> 16) & 0xff;
171 pos += 3 - padding;
172 }
173
174 /* Zero terminate */
175 *pos = '\0';
176
177 /* Return the decoded data */
178 *outptr = newstr;
179 *outlen = rawlen;
180
181 return CURLE_OK;
182bad:
183 free(newstr);
184 return CURLE_BAD_CONTENT_ENCODING;
185}
186
187static CURLcode base64_encode(const char *table64,
188 const char *inputbuff, size_t insize,
189 char **outptr, size_t *outlen)
190{
191 char *output;
192 char *base64data;
193 const unsigned char *in = (unsigned char *)inputbuff;
194 const char *padstr = &table64[64]; /* Point to padding string. */
195
196 *outptr = NULL;
197 *outlen = 0;
198
199 if(!insize)
200 insize = strlen(s: inputbuff);
201
202#if SIZEOF_SIZE_T == 4
203 if(insize > UINT_MAX/4)
204 return CURLE_OUT_OF_MEMORY;
205#endif
206
207 base64data = output = malloc((insize + 2) / 3 * 4 + 1);
208 if(!output)
209 return CURLE_OUT_OF_MEMORY;
210
211 while(insize >= 3) {
212 *output++ = table64[ in[0] >> 2 ];
213 *output++ = table64[ ((in[0] & 0x03) << 4) | (in[1] >> 4) ];
214 *output++ = table64[ ((in[1] & 0x0F) << 2) | ((in[2] & 0xC0) >> 6) ];
215 *output++ = table64[ in[2] & 0x3F ];
216 insize -= 3;
217 in += 3;
218 }
219 if(insize) {
220 /* this is only one or two bytes now */
221 *output++ = table64[ in[0] >> 2 ];
222 if(insize == 1) {
223 *output++ = table64[ ((in[0] & 0x03) << 4) ];
224 if(*padstr) {
225 *output++ = *padstr;
226 *output++ = *padstr;
227 }
228 }
229 else {
230 /* insize == 2 */
231 *output++ = table64[ ((in[0] & 0x03) << 4) | ((in[1] & 0xF0) >> 4) ];
232 *output++ = table64[ ((in[1] & 0x0F) << 2) ];
233 if(*padstr)
234 *output++ = *padstr;
235 }
236 }
237
238 /* Zero terminate */
239 *output = '\0';
240
241 /* Return the pointer to the new data (allocated memory) */
242 *outptr = base64data;
243
244 /* Return the length of the new data */
245 *outlen = output - base64data;
246
247 return CURLE_OK;
248}
249
250/*
251 * Curl_base64_encode()
252 *
253 * Given a pointer to an input buffer and an input size, encode it and
254 * return a pointer in *outptr to a newly allocated memory area holding
255 * encoded data. Size of encoded data is returned in variable pointed by
256 * outlen.
257 *
258 * Input length of 0 indicates input buffer holds a NUL-terminated string.
259 *
260 * Returns CURLE_OK on success, otherwise specific error code. Function
261 * output shall not be considered valid unless CURLE_OK is returned.
262 *
263 * @unittest: 1302
264 */
265CURLcode Curl_base64_encode(const char *inputbuff, size_t insize,
266 char **outptr, size_t *outlen)
267{
268 return base64_encode(table64: base64encdec, inputbuff, insize, outptr, outlen);
269}
270
271/*
272 * Curl_base64url_encode()
273 *
274 * Given a pointer to an input buffer and an input size, encode it and
275 * return a pointer in *outptr to a newly allocated memory area holding
276 * encoded data. Size of encoded data is returned in variable pointed by
277 * outlen.
278 *
279 * Input length of 0 indicates input buffer holds a NUL-terminated string.
280 *
281 * Returns CURLE_OK on success, otherwise specific error code. Function
282 * output shall not be considered valid unless CURLE_OK is returned.
283 *
284 * @unittest: 1302
285 */
286CURLcode Curl_base64url_encode(const char *inputbuff, size_t insize,
287 char **outptr, size_t *outlen)
288{
289 return base64_encode(table64: base64url, inputbuff, insize, outptr, outlen);
290}
291
292#endif /* no users so disabled */
293