Skip to content

fix(conversion): prevent Base64Decode panic and Base64Encode input mutation#808

Open
SAY-5 wants to merge 1 commit into
TheAlgorithms:masterfrom
SAY-5:fix-base64-malformed-input
Open

fix(conversion): prevent Base64Decode panic and Base64Encode input mutation#808
SAY-5 wants to merge 1 commit into
TheAlgorithms:masterfrom
SAY-5:fix-base64-malformed-input

Conversation

@SAY-5

@SAY-5 SAY-5 commented Jun 18, 2026

Copy link
Copy Markdown

Description of Change

Base64Decode indexes input[i+1]/input[i+2]/input[i+3] for every step of 4, so any input whose length is not a multiple of 4 panics with index out of range instead of returning. The decoder now iterates over whole 4-character groups only, so a malformed-length payload is ignored at the tail rather than reading past the end of the string.

Base64Encode padded short final groups by appending zero bytes to the input slice. When the caller passes a slice with spare capacity (e.g. Base64Encode(buf[:n])), append writes those zeros into the caller's backing array and corrupts data observed through other slice headers. The padding bytes are now read locally, so the argument is left untouched.

Added regression tests for both: decoding inputs of length 1, 2, 3 and 5, and encoding a sub-slice whose backing array must remain unchanged.

Closes #807

Checklist

  • Added description of change
  • Added file name matches File name guidelines
  • Added tests and example, test must pass
  • Added documentation so that the program is self-explanatory and educational - GoDoc guidelines
  • Relevant documentation/comments is changed or added
  • PR title follows semantic commit guidelines
  • Search previous suggestions before making a new one, as yours may be a duplicate.
  • I acknowledge that all my contributions will be made under the project's license.

Notes: Guard base64 decode/encode against malformed-length input and caller-slice mutation.

…tation

Signed-off-by: Sai Asish Y <say.apm35@gmail.com>
@codacy-production

Copy link
Copy Markdown

Not up to standards ⛔

NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

conversion/base64: Base64Encode mutates caller's input slice; Base64Decode panics on malformed-length input

1 participant