From: Moriyoshi Koizumi <moriyoshi@php.net>
Date: Sun, 1 Dec 2002 02:44:50 +0000 (+0000)
Subject: Fixed possible buffer overflow in php_base64_decode();
X-Git-Tag: RELEASE_1_0b3~238
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=aeb6a6c45884133bd68535e671d44b8d2577b463;p=php

Fixed possible buffer overflow in php_base64_decode();
# This bug doesn't appear to be harmful for now,
# so I won't merge it into branches...
---

diff --git a/ext/standard/base64.c b/ext/standard/base64.c
index 18f1e9c532..4fefd1bc54 100644
--- a/ext/standard/base64.c
+++ b/ext/standard/base64.c
@@ -140,7 +140,7 @@ unsigned char *php_base64_decode(const unsigned char *str, int length, int *ret_
 	}
 
 	/* run through the whole string, converting as we go */
-	while ((ch = *current++) != '\0') {
+	while ((ch = *current++) != '\0' && length-- > 0) {
 		if (ch == base64_pad) break;
 
 	    /* When Base64 gets POSTed, all pluses are interpreted as spaces.