From b24021aea09f5e2fdaa8e68ce383f0f90693ff92 Mon Sep 17 00:00:00 2001 From: Shihao Date: Sat, 19 Sep 2026 10:45:13 -0400 Subject: [PATCH v1 1/3] Reject data after padding in base64 decoding decode() kept reading after the "=" padding that ends a base64 value. It took more data, and more "=" at any position, and cut each later group short. So 'YQ==AAAA' gave \x6100 with no error. Raise an error for anything but whitespace after the padding, as base32hex does. Bug: #19702 Reported-by: Qifan Liu Author: Shihao Zhong Discussion: https://postgr.es/m/19702-9ed4a131fcfadb9d@postgresql.org --- src/backend/utils/adt/encode.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/src/backend/utils/adt/encode.c b/src/backend/utils/adt/encode.c index b9d4f2811d7..7aa56466718 100644 --- a/src/backend/utils/adt/encode.c +++ b/src/backend/utils/adt/encode.c @@ -536,8 +536,8 @@ pg_base64_decode_internal(const char *src, size_t len, char *dst, bool url) if (c == '=') { - /* end sequence */ - if (!end) + /* end sequence, after it only the second "=" of "==" is allowed */ + if (!end || pos != 3) { if (pos == 2) end = 1; @@ -556,7 +556,8 @@ pg_base64_decode_internal(const char *src, size_t len, char *dst, bool url) else { b = -1; - if (c > 0 && c < 127) + /* no data is allowed after padding */ + if (c > 0 && c < 127 && !end) b = b64lookup[(unsigned char) c]; if (b < 0) { @@ -583,12 +584,12 @@ pg_base64_decode_internal(const char *src, size_t len, char *dst, bool url) } } - if (url && pos == 2) + if (url && !end && pos == 2) { buf <<= 12; *p++ = (buf >> 16) & 0xFF; } - else if (url && pos == 3) + else if (url && !end && pos == 3) { buf <<= 6; *p++ = (buf >> 16) & 0xFF; -- 2.37.1 (Apple Git-137.1)