From 4d31e3c917a05541394c544708f0047cfb53331a Mon Sep 17 00:00:00 2001
From: Mateusz Poliwczak <mpoliwczak34@gmail.com>
Date: Thu, 23 Mar 2023 18:01:21 +0100
Subject: [PATCH] std.base64: don't overflow dest with padding

---
 lib/std/base64.zig | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/lib/std/base64.zig b/lib/std/base64.zig
index 83f07b9c185486c9e0768a31caace0b6b06a00ce..d9bf7d4a077e9a1bc35e013817e52d3f27e5b767 100644
--- a/lib/std/base64.zig
+++ b/lib/std/base64.zig
@@ -117,7 +117,7 @@ pub const Base64Encoder = struct {
             out_idx += 1;
         }
         if (encoder.pad_char) |pad_char| {
-            for (dest[out_idx..]) |*pad| {
+            for (dest[out_idx..out_len]) |*pad| {
                 pad.* = pad_char;
             }
         }
@@ -305,6 +305,20 @@ test "base64" {
     comptime try testAllApis(standard, "comptime", "Y29tcHRpbWU=");
 }
 
+test "base64 padding dest overflow" {
+    const input = "foo";
+
+    var expect: [128]u8 = undefined;
+    std.mem.set(u8, &expect, 0);
+    _ = url_safe.Encoder.encode(expect[0..url_safe.Encoder.calcSize(input.len)], input);
+
+    var got: [128]u8 = undefined;
+    std.mem.set(u8, &got, 0);
+    _ = url_safe.Encoder.encode(&got, input);
+
+    try std.testing.expectEqualSlices(u8, &expect, &got);
+}
+
 test "base64 url_safe_no_pad" {
     @setEvalBranchQuota(8000);
     try testBase64UrlSafeNoPad();
-- 
2.54.0