Uploaded image for project: 'EJBCA'
  1. EJBCA
  2. ECA-6481

Base64 decoding fails with BC v1.59

    Details

    • Type: Bug
    • Status: Closed
    • Priority: Critical
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: EJBCA 6.11.1
    • Component/s: None
    • Issue discovered during:
      Jenkins
    • Sprint:
      EJBCA Happy Fun Sprint (6)

      Description

      I think BC 1.59's base64 decoder contains a bug.

      Actually it's not a bug, but a behavioural change in BC where incorrectly padded base64 strings are no longer accepted (results in DecoderException).

      Test which fails with a DecoderException in BC 1.59, but passed in BC 1.58

      @Test
      public void testDecode() {
          Base64.decode("DAxFSkJDQSBTYW".getBytes());
      }
      

      The change which caused the bug the improvement is in commit ea9172fe8437daa6223b928bfd85b18a6fa93caf.

      See history for Base64Encoder.java for a complete list of changes.

      Here is the response from David Hook:

      Hi Bastian,
      
      Yes, the intention of the changes was to further eliminate any possibility of incorrectly encoded data getting through. There is already at least one certification regime that includes tests around this.
      
      If you do come across any incorrect strings that do get through, please let us know.
      
      Just to check - you are referring to the ArrayIndexOutOfBoundsException as it is the cause aren't you? I see
      a DecoderException here (which is what should happen).
      
      If you have any further questions, please let me know.
      
      Thanks,
      
      David
      

        Attachments

        1. ECA-6481.patch
          4 kB
          Bastian Fredriksson
        2. Regression in BC v1.59 Base64 Encoder.eml
          7 kB
          Bastian Fredriksson

          Issue Links

            Activity

              People

              Assignee:
              bastianf Bastian Fredriksson
              Reporter:
              bastianf Bastian Fredriksson
              Verified by:
              Mike Agrenius Kushner
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - 1 hour Original Estimate - 1 hour
                  1h
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 4 hours, 1 minute
                  4h 1m