From: Lauri Kenttä <lauri.kentta@gmail.com>
Date: Wed, 25 May 2016 17:28:45 +0000 (+0300)
Subject: base64_decode: reorder to fix out of bounds read
X-Git-Tag: php-7.1.0beta1~154^2~6
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c65de8ac1302a3b9825a6abe19c87fe45c68698a;p=php

base64_decode: reorder to fix out of bounds read
---

diff --git a/ext/standard/base64.c b/ext/standard/base64.c
index 81f826c9a8..352e7ea52c 100644
--- a/ext/standard/base64.c
+++ b/ext/standard/base64.c
@@ -143,16 +143,19 @@ PHPAPI zend_string *php_base64_decode_ex(const unsigned char *str, size_t length
 	result = zend_string_alloc(length, 0);
 
 	/* run through the whole string, converting as we go */
-	while ((ch = *current++) != '\0' && length-- > 0) {
+	while (length-- > 0 && (ch = *current++) != '\0') {
 		if (ch == base64_pad) {
-			if (*current != '=' && ((i % 4) == 1 || (strict && length > 0))) {
-				if ((i % 4) != 1) {
-					while (isspace(*(++current))) {
-						continue;
-					}
-					if (*current == '\0') {
-						continue;
-					}
+			if (i % 4 == 1) {
+				if (length == 0 || *current != '=') {
+					zend_string_free(result);
+					return NULL;
+				}
+			} else if (length > 0 && *current != '=' && strict) {
+				while (--length > 0 && isspace(*++current)) {
+					continue;
+				}
+				if (length == 0 || *current == '\0') {
+					continue;
 				}
 				zend_string_free(result);
 				return NULL;