MFB: Fixed bug #47174 (base64_decode() interprets pad char in mid string as

terminator)

diff --git a/ext/standard/base64.c b/ext/standard/base64.c
index 8fa2a923b99fdeb218fab740d0017c152b50b582..2533442260b73d19e32473139765c4d8a14e2e87 100644 (file)
--- a/ext/standard/base64.c
+++ b/ext/standard/base64.c
@@ -151,7 +151,14 @@ PHPAPI unsigned char *php_base64_decode_ex(const unsigned char *str, int length,
 
        /* run through the whole string, converting as we go */
        while ((ch = *current++) != '\0' && length-- > 0) {
-               if (ch == base64_pad) break;
+               if (ch == base64_pad) {
+                       if (*current != '=' && (i % 4) == 1) {
+                               efree(result);
+                               return NULL;
+                       }
+                       i++;
+                       continue;
+               }
 
                ch = base64_reverse_table[ch];
                if ((!strict && ch < 0) || ch == -1) { /* a space or some other separator character, we simply skip over */