The following bug has been logged on the website:
Bug reference: 19702
Logged by: Qifan Liu
Email address: imchifan@163.com
PostgreSQL version: 18.6
Operating system: Linux/amd64
Description:
decode() accepts Base64 alphabet characters after terminal '=' padding and
incorporates them into the decoded bytea value. Once terminal padding
completes a Base64 value, only ignorable whitespace may follow. Applications
relying on decode() to validate Base64 input may consequently process
malformed input as valid data.
Steps to reproduce
------------------
Run the following with psql:
\set ON_ERROR_STOP on
SELECT encode(decode('YQ==Yg==', 'base64'), 'hex') AS decoded_hex;
SELECT encode(decode('YQ==AAAA', 'base64'), 'hex') AS
decoded_hex_after_padding;
Actual result
-------------
decoded_hex
-------------
6162
(1 row)
decoded_hex_after_padding
---------------------------
6100
(1 row)
Expected result
---------------
Both decode() calls should reject their input with SQLSTATE 22023 because
Base64 alphabet characters occur after terminal '=' padding. They should not
silently decode the trailing payload.
Additional information
----------------------
The issue was reproduced on PostgreSQL 20devel, PostgreSQL 18.6, and
PostgreSQL 17.11.
