current/SOURCES/CVE-2016-8617.patch

--- curl-7.40.0/lib/base64.c.0023       2016-11-03 12:50:20.579714622 +0200
+++ curl-7.40.0/lib/base64.c    2016-11-03 12:51:49.739059261 +0200
@@ -176,40 +176,45 @@
                               const char *inputbuff, size_t insize,
                               char **outptr, size_t *outlen)
 {
   CURLcode error;
   unsigned char ibuf[3];
   unsigned char obuf[4];
   int i;
   int inputparts;
   char *output;
   char *base64data;
   char *convbuf = NULL;
 
   const char *indata = inputbuff;
 
   *outptr = NULL;
   *outlen = 0;
 
   if(0 == insize)
     insize = strlen(indata);
 
+#if SIZEOF_SIZE_T == 4
+  if(insize > UINT_MAX/4)
+    return CURLE_OUT_OF_MEMORY;
+#endif
+
   base64data = output = malloc(insize*4/3+4);
   if(NULL == output)
     return CURLE_OUT_OF_MEMORY;
 
   /*
    * The base64 data needs to be created using the network encoding
    * not the host encoding.  And we can't change the actual input
    * so we copy it to a buffer, translate it, and use that instead.
    */
   error = Curl_convert_clone(data, indata, insize, &convbuf);
   if(error) {
     free(output);
     return error;
   }
 
   if(convbuf)
     indata = (char *)convbuf;
 
   while(insize > 0) {
     for(i = inputparts = 0; i < 3; i++) {
1	--- curl-7.40.0/lib/base64.c.0023 2016-11-03 12:50:20.579714622 +0200
2	+++ curl-7.40.0/lib/base64.c 2016-11-03 12:51:49.739059261 +0200
3	@@ -176,40 +176,45 @@
4	const char *inputbuff, size_t insize,
5	char *outptr, size_t outlen)
6	{
7	CURLcode error;
8	unsigned char ibuf[3];
9	unsigned char obuf[4];
10	int i;
11	int inputparts;
12	char *output;
13	char *base64data;
14	char *convbuf = NULL;
15
16	const char *indata = inputbuff;
17
18	*outptr = NULL;
19	*outlen = 0;
20
21	if(0 == insize)
22	insize = strlen(indata);
23
24	+#if SIZEOF_SIZE_T == 4
25	+ if(insize > UINT_MAX/4)
26	+ return CURLE_OUT_OF_MEMORY;
27	+#endif
28	+
29	base64data = output = malloc(insize*4/3+4);
30	if(NULL == output)
31	return CURLE_OUT_OF_MEMORY;
32
33	/*
34	* The base64 data needs to be created using the network encoding
35	* not the host encoding. And we can't change the actual input
36	* so we copy it to a buffer, translate it, and use that instead.
37	*/
38	error = Curl_convert_clone(data, indata, insize, &convbuf);
39	if(error) {
40	free(output);
41	return error;
42	}
43
44	if(convbuf)
45	indata = (char *)convbuf;
46
47	while(insize > 0) {
48	for(i = inputparts = 0; i < 3; i++) {