worker: fix heap buffer overflow in webvpncontext= cookie decoding

An unauthenticated client could send a Cookie header with a webvpncontext=
value long enough that its base64-decoded length far exceeded SID_SIZE (32
bytes).  The decoder wrote directly into ws->sid without a prior length
check, overwriting adjacent fields in worker_st and crashing the worker.

The webvpn= cookie already had the correct pattern: check decoded length
bounds before decoding, decode into the ws->buffer scratch area, then
memcpy into the target only on an exact-size match.  Apply the same
pattern to webvpncontext=.

Resolves: #719

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>

NEWS

@@ -1,4 +1,6 @@
 * Version 1.5.0 (unreleased)
+- [SECURITY] Fixed unauthenticated heap buffer overflow in the unprivileged
+  worker process via an oversized webvpncontext= cookie value (#719)
 - Added `syslog-facility` option to log to specified syslog facility (#691)
 - Fixed worker hang when a client disappears silently (#638)
 - Removed the 'cgroup' configuration option (used for cgroups v1).

src/worker-http.c

@@ -719,14 +719,23 @@ ciphersuite12_finish:
 				}
 
 				nlen = BASE64_DECODE_LENGTH(tmplen);
+				if (nlen < sizeof(ws->sid) ||
+				    nlen > sizeof(ws->sid) + 8)
+					return;
+
+				if (sizeof(ws->buffer) < sizeof(ws->sid) + 8)
+					abort();
+
 				ret = oc_base64_decode((uint8_t *)p, tmplen,
-						       ws->sid, &nlen);
+						       ws->buffer, &nlen);
 				if (ret == 0 || nlen != sizeof(ws->sid)) {
 					oclog(ws, LOG_SENSITIVE,
 					      "could not decode sid: %.*s",
 					      tmplen, p);
 					ws->sid_set = 0;
 				} else {
+					memcpy(ws->sid, ws->buffer,
+					       sizeof(ws->sid));
 					ws->sid_set = 1;
 					oclog(ws, LOG_SENSITIVE,
 					      "received sid: %.*s", tmplen, p);