Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Subject: BUG #19702: decode() accepts Base64 payload after terminal padding
To: pgsql-bugs@lists.postgresql.org
From: PG Bug reporting form <noreply@postgresql.org>
Cc: imchifan@163.com
Reply-To: imchifan@163.com, pgsql-bugs@lists.postgresql.org
Date: Sat, 19 Sep 2026 11:15:48 +0000
Message-ID: <19702-9ed4a131fcfadb9d@postgresql.org>
Auto-Submitted: auto-generated
Archived-At: 
 <https://www.postgresql.org/message-id/19702-9ed4a131fcfadb9d%40postgresql.org>
Precedence: bulk

The following bug has been logged on the website:

Bug reference:      19702
Logged by:          Qifan Liu
Email address:      imchifan@163.com
PostgreSQL version: 18.6
Operating system:   Linux/amd64
Description:       =20

decode() accepts Base64 alphabet characters after terminal '=3D' padding and
incorporates them into the decoded bytea value. Once terminal padding
completes a Base64 value, only ignorable whitespace may follow. Applications
relying on decode() to validate Base64 input may consequently process
malformed input as valid data.

Steps to reproduce
------------------
Run the following with psql:

\set ON_ERROR_STOP on
SELECT encode(decode('YQ=3D=3DYg=3D=3D', 'base64'), 'hex') AS decoded_hex;
SELECT encode(decode('YQ=3D=3DAAAA', 'base64'), 'hex') AS
decoded_hex_after_padding;

Actual result
-------------
 decoded_hex
-------------
 6162
(1 row)

 decoded_hex_after_padding
---------------------------
 6100
(1 row)

Expected result
---------------
Both decode() calls should reject their input with SQLSTATE 22023 because
Base64 alphabet characters occur after terminal '=3D' padding. They should =
not
silently decode the trailing payload.

Additional information
----------------------
The issue was reproduced on PostgreSQL 20devel, PostgreSQL 18.6, and
PostgreSQL 17.11.