PHP :: Bug #27460 :: base64_decode fails to follow RFC 3548 completely
- ️Tue Mar 02 2004
Bug #27460 | base64_decode fails to follow RFC 3548 completely | |||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Submitted: | 2004-03-02 09:43 UTC | Modified: | 2004-03-06 13:58 UTC |
|
||||||||||
From: | naish at klanen dot net | Assigned: | ||||||||||||
Status: | Closed | Package: | URL related | |||||||||||
PHP Version: | 4.3.4 | OS: | Suse Linux 9.0 (2.4.21) | |||||||||||
Private report: | No | CVE-ID: | None |
[2004-03-02 09:43 UTC] naish at klanen dot net
Description: ------------ If a base64 encoded string contains a non-needed "=" at the end of the string base64_decode returns false even though the string has been correctly decoded. The standard for base64 even specifies that a file may contain non-needed padding chars. http://www.faqs.org/rfcs/rfc3548.html - snip - Furthermore, such specifications may consider the pad character, "=", as not part of the base alphabet until the end of the string. If more than the allowed number of pad characters are found at the end of the string, e.g., a base 64 string terminated with "===", the excess pad characters could be ignored. - /snip - The fix is simple. In ext/standard/base64.c insert the following code: if (ch == base64_pad) { switch(i % 4) { case 1: efree(result); return NULL; case 2: k++; case 3: result[k++] = 0; } } in the base64_decode function. Notice that the only thing I did was remove "case 0:" on line 191. Reproduce code: --------------- <?php $string=base64_encode("123456"); echo $string."\n"; //Insert a not-needed padding char. $string.="="; //This returns false even though $string is valid base64 var_dump(base64_decode($string)); ?> Expected result: ---------------- $string should been encoded to base64 and later decoded with 1 extra "=" added at the end. Actual result: -------------- PHP fails to decode the string properly.
Patches
Pull Requests
History
AllCommentsChangesGit/SVN commitsRelated reports
[2004-03-06 13:58 UTC] iliaa@php.net
This bug has been fixed in CVS. Snapshots of the sources are packaged every three hours; this change will be in the next snapshot. You can grab the snapshot at http://snaps.php.net/. Thank you for the report, and for helping us make PHP better.