From 586a0761ff5e2bd1befcc35119f833fd32f6597e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lauri=20Kentt=C3=A4?= Date: Mon, 11 Jul 2016 12:40:07 +0300 Subject: [PATCH] base64_decode: strict: Fail on truncated input --- ext/standard/base64.c | 4 ++++ .../tests/url/base64_decode_variation_001.phpt | 10 +++++----- 2 files changed, 9 insertions(+), 5 deletions(-) diff --git a/ext/standard/base64.c b/ext/standard/base64.c index fb21759392b..cf6951ba8d4 100644 --- a/ext/standard/base64.c +++ b/ext/standard/base64.c @@ -193,6 +193,10 @@ PHPAPI zend_string *php_base64_decode_ex(const unsigned char *str, size_t length } i++; } + /* fail if the input is truncated (only one char in last group) */ + if (strict && i % 4 == 1) { + goto fail; + } ZSTR_LEN(result) = j; ZSTR_VAL(result)[ZSTR_LEN(result)] = '\0'; diff --git a/ext/standard/tests/url/base64_decode_variation_001.phpt b/ext/standard/tests/url/base64_decode_variation_001.phpt index 8734a96e0bf..f4906a774a0 100644 --- a/ext/standard/tests/url/base64_decode_variation_001.phpt +++ b/ext/standard/tests/url/base64_decode_variation_001.phpt @@ -95,13 +95,13 @@ Error: 8 - Undefined variable: undefined_var, %s(%d) Error: 8 - Undefined variable: unset_var, %s(%d) -- Arg value 0 -- -string(0) "" +bool(false) -- Arg value 1 -- -string(0) "" +bool(false) -- Arg value 12345 -- -string(6) "d76df8" +bool(false) -- Arg value -2345 -- bool(false) @@ -148,13 +148,13 @@ string(0) "" string(0) "" -- Arg value true -- -string(0) "" +bool(false) -- Arg value false -- string(0) "" -- Arg value TRUE -- -string(0) "" +bool(false) -- Arg value FALSE -- string(0) ""