OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

跨界内存读

OpenZeppelin 安全漏洞

OpenZeppelin是一个应用软件。一个安全区块链应用的标准。 OpenZeppelin Contracts 5.0.2之前版本和4.9.6之前版本存在安全漏洞，该漏洞源于当该输入不是3的倍数时，Base64.encode函数最后一次迭代可以读取输入缓冲器之外的存储器部分。

N/A

N/A