Fixed bug #47174 (base64_decode() interprets pad char in mid string as

terminator)

diff --git a/ext/standard/base64.c b/ext/standard/base64.c
index 62083b347615aa5a0d6a97895051886b3f02b6dd..9b835409d19f56ae973ec502e37168d15dc4c731 100644 (file)
--- a/ext/standard/base64.c
+++ b/ext/standard/base64.c
@@ -151,7 +151,14 @@ PHPAPI unsigned char *php_base64_decode_ex(const unsigned char *str, int length,
 
        /* run through the whole string, converting as we go */
        while ((ch = *current++) != '\0' && length-- > 0) {
-               if (ch == base64_pad) break;
+               if (ch == base64_pad) {
+                       if (*current != '=' && (i % 4) == 1) {
+                               efree(result);
+                               return NULL;
+                       }
+                       i++;
+                       continue;
+               }
 
                ch = base64_reverse_table[ch];
                if ((!strict && ch < 0) || ch == -1) { /* a space or some other separator character, we simply skip over */