php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #55273 base64_decode with strict rejects whitespace after pad
Submitted: 2011-07-23 21:22 UTC Modified: 2011-09-12 17:20 UTC
From: ljb9832 at pobox dot com Assigned: iliaa
Status: Closed Package: URL related
PHP Version: 5.3.6 OS: N/A
Private report: No CVE-ID:
 [2011-07-23 21:22 UTC] ljb9832 at pobox dot com
Description:
------------
Per RFC2045, section 6.8, base64 decoding should not count line breaks and other whitespace as errors. When using $strict=True, base64_decode() does ignore whitespace, except at the end of any base64 encoded data that ends with padding characters (=). If there is whitespace after the padding character(s), the string is rejected under strict testing. This is incorrect. 

One particular problem with this is that you cannot reliably round-trip base64 encode/decode with strict checking when using chunk_split() on the encoded data, because chunk_split puts a newline at the end of the data. If the length of the original data is a multiple of 3, it works, otherwise it does not. 

Test script:
---------------
<?php
function test($s)
{
  $v = chunk_split(base64_encode($s));
  $r = base64_decode($v, True);
  echo "$s=";
  var_dump($r);
}
test('PHP');
test('PH');
test('P');

Expected result:
----------------
PHP=string(3) "PHP"
PH=string(2) "PH"
P=string(1) "P"


Actual result:
--------------
PHP=string(3) "PHP"
PH=bool(false)
P=bool(false)


Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2011-09-12 17:20 UTC] iliaa@php.net
Automatic comment from SVN on behalf of iliaa
Revision: http://svn.php.net/viewvc/?view=revision&amp;revision=316560
Log: Fixed bug #55273 (base64_decode() with strict rejects whitespace after pad)
 [2011-09-12 17:20 UTC] iliaa@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: iliaa
 [2011-09-12 17:20 UTC] iliaa@php.net
This bug has been fixed in SVN.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.


 [2012-04-18 09:48 UTC] laruence@php.net
Automatic comment on behalf of iliaa
Revision: http://git.php.net/?p=php-src.git;a=commit;h=3d3a6a3b965fa059f30d52f8de6f4251af887f6a
Log: Fixed bug #55273 (base64_decode() with strict rejects whitespace after pad)
 [2012-07-24 23:40 UTC] rasmus@php.net
Automatic comment on behalf of iliaa
Revision: http://git.php.net/?p=php-src.git;a=commit;h=3d3a6a3b965fa059f30d52f8de6f4251af887f6a
Log: Fixed bug #55273 (base64_decode() with strict rejects whitespace after pad)
 [2013-11-17 09:36 UTC] laruence@php.net
Automatic comment on behalf of iliaa
Revision: http://git.php.net/?p=php-src.git;a=commit;h=3d3a6a3b965fa059f30d52f8de6f4251af887f6a
Log: Fixed bug #55273 (base64_decode() with strict rejects whitespace after pad)
 
PHP Copyright © 2001-2014 The PHP Group
All rights reserved.
Last updated: Sun Apr 20 15:01:54 2014 UTC