src: fix base64 decoding

Make sure trailing garbage is not treated as a valid base64 character. Fixes: #11987 PR-URL: #11995 Reviewed-By: Anna Henningsen <anna@addaleax.net>
nodejs · Apr 10, 2017 · ffbcfdf · ffbcfdf
1 parent 8823861
commit ffbcfdf
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 2 deletions.
diff --git a/src/base64.h b/src/base64.h
@@ -60,13 +60,13 @@ size_t base64_decode_slow(char* dst, size_t dstlen,
   size_t k = 0;
   for (;;) {
 #define V(expr)                                                               \
-    while (i < srclen) {                                                      \
+    for (;;) {                                                                \
       const uint8_t c = src[i];                                               \
       lo = unbase64(c);                                                       \
       i += 1;                                                                 \
       if (lo < 64)                                                            \
         break;  /* Legal character. */                                        \
-      if (c == '=')                                                           \
+      if (c == '=' || i >= srclen)                                            \
         return k;                                                             \
     }                                                                         \
     expr;                                                                     \

diff --git a/test/parallel/test-buffer-alloc.js b/test/parallel/test-buffer-alloc.js
@@ -462,6 +462,10 @@ assert.strictEqual(
 // Regression test for https://github.com/nodejs/node/issues/3496.
 assert.strictEqual(Buffer.from('=bad'.repeat(1e4), 'base64').length, 0);
 
+// Regression test for https://github.com/nodejs/node/issues/11987.
+assert.deepStrictEqual(Buffer.from('w0  ', 'base64'),
+                       Buffer.from('w0', 'base64'));
+
 {
   // Creating buffers larger than pool size.
   const l = Buffer.poolSize + 5;