MFB: Fixed bug #47174 (base64_decode() interprets pad char in mid string as

terminator)

NEWS

@@ -17,6 +17,8 @@ PHP                                                                        NEWS
 - Fixed bug in xml_error_string() which resulted in messages being
   off by one. (Scott)
 
+- Fixed bug #47174 (base64_decode() interprets pad char in mid string as
+  terminator). (Ilia)
 - Fixed bug #47165 (Possible memory corruption when passing return value by
   reference). (Dmitry)
 - Fixed bug #47152 (gzseek/fseek using SEEK_END produces strange results).

ext/standard/base64.c

@@ -153,7 +153,14 @@ PHPAPI unsigned char *php_base64_decode_ex(const unsigned char *str, int length,
 
 	/* run through the whole string, converting as we go */
 	while ((ch = *current++) != '\0' && length-- > 0) {
-		if (ch == base64_pad) break;
+		if (ch == base64_pad) {
+			if (*current != '=' && (i % 4) == 1) {
+				efree(result);
+				return NULL;
+			}
+			i++;
+			continue;
+		}
 
 		ch = base64_reverse_table[ch];
 		if ((!strict && ch < 0) || ch == -1) { /* a space or some other separator character, we simply skip over */