Re: BUG #19702: decode() accepts Base64 payload after terminal padding

> On 19 Sep 2026, at 16:59, shihao zhong <zhong950419(at)gmail(dot)com> wrote:
>
> Hi Qifan,
>
> Thanks for reporting that issue.
>
> I can reproduce this on master. The decoder sets "end" at the first "="
> and never looks at it again, so later data and later "=" all pass

Sorry for missing this at the time of it being reported.

> 0001 raises an error for anything but whitespace after the padding, the
> same rule base32hex already has. 0002 adds tests. 0003 fixes the two
> copies of this code, pg_b64_decode() in src/common and the armor decoder
> in pgcrypto. dearmor() shows the same bug when the CRC matches.

I had to stare the code for some time to convince myself there were no more
bugs hiding in pgcrypto for this wrt RFC9580, but I think it's correct.

> This rejects input that used to pass, so I am not sure about the back
> branches. I would leave that to the committer.

Thanks for the patches, the attached is a rebased squash of the three patches
since I would prefer to apply them all at once. Given the lack of complaints I
will err on the side of caution and keep this in master only. At least for now.

--
Daniel Gustafsson