Fixed a bug of the base64 decoder that a sequence of intervening

characters that are supposed to be ignored by the decoder cause output
corruption.

diff --git a/ext/standard/filters.c b/ext/standard/filters.c
index be7346fc2e6408f458171fb788c43ef5a836b676..9966305c70fc3b2573d1644891000f6a718f7d70 100644 (file)
--- a/ext/standard/filters.c
+++ b/ext/standard/filters.c
@@ -526,9 +526,6 @@ static php_conv_err_t php_conv_base64_decode_convert(php_conv_base64_decode *ins
                }
                if ((pack_bcnt | ustat) == 0) {
                        if (ocnt < 1) {
-                               urem |= (pack << urem_nbits);
-                               urem_nbits += 8;
-
                                err = PHP_CONV_ERR_TOO_BIG;
                                break;
                        }
@@ -539,6 +536,14 @@ static php_conv_err_t php_conv_base64_decode_convert(php_conv_base64_decode *ins
                }
        }
 
+       if (urem_nbits >= pack_bcnt) {
+               urem |= (pack << (urem_nbits - pack_bcnt));
+               urem_nbits += (nbitsof_pack - pack_bcnt);
+       } else {
+               urem |= (pack >> (pack_bcnt - urem_nbits));
+               urem_nbits += (nbitsof_pack - pack_bcnt);
+       }
+
        inst->urem = urem;
        inst->urem_nbits = urem_nbits;
        inst->ustat = ustat;