oidc_util_base64_decode: check NULL inputs

test: complete util/base64.c coverage

Signed-off-by: Hans Zandbelt <[email protected]>

Author: zandbelt

ChangeLog

@@ -1,6 +1,8 @@
 08/31/2025
 - pass JSON real claims without trailing zeros, use 8 digits precision instead of 6
 - test: complete util/appinfo.c coverage
+- oidc_util_base64_decode: check NULL inputs
+- test: complete util/base64.c coverage
 
 08/27/2025
 - improve Redis (and Metrics) performance on process MPMs by using

src/util/base64.c

@@ -82,11 +82,15 @@ int oidc_util_base64url_encode(request_rec *r, char **dst, const char *src, int
  * parse a base64 encoded binary value from the provided string
  */
 char *oidc_util_base64_decode(apr_pool_t *pool, const char *input, char **output, int *output_len) {
-	int len = apr_base64_decode_len(input);
-	*output = apr_pcalloc(pool, len);
+	if ((input == NULL) || (output == NULL) || (output_len == 0))
+		return apr_psprintf(pool, "base64-decoding of failed: invalid parameters");
+
+	*output = apr_pcalloc(pool, apr_base64_decode_len(input));
 	*output_len = apr_base64_decode(*output, input);
+
 	if (*output_len <= 0)
 		return apr_psprintf(pool, "base64-decoding of \"%s\" failed", input);
+
 	return NULL;
 }
 

test/test_util.c

@@ -49,7 +49,13 @@
 START_TEST(test_util_base64url_encode) {
 	int len = -1;
 	char *dst = NULL;
-	const char *src = "test";
+	const char *src = NULL;
+
+	len = oidc_util_base64url_encode(oidc_test_request_get(), &dst, NULL, 0, 1);
+	ck_assert_ptr_null(dst);
+	ck_assert_int_eq(len, -1);
+
+	src = "test";
 	len = oidc_util_base64url_encode(oidc_test_request_get(), &dst, src, _oidc_strlen(src), 1);
 	ck_assert_msg(dst != NULL, "dst value is NULL");
 	ck_assert_int_eq(len, 6);
@@ -69,6 +75,16 @@ START_TEST(test_util_base64_decode) {
 	const char *input = "dGVzdA==";
 	char *output = NULL;
 	int len = -1;
+
+	rv = oidc_util_base64_decode(oidc_test_pool_get(), NULL, &output, &len);
+	ck_assert_ptr_nonnull(rv);
+	ck_assert_ptr_null(output);
+	ck_assert_int_eq(len, -1);
+
+	rv = oidc_util_base64_decode(oidc_test_pool_get(), "\\", &output, &len);
+	ck_assert_ptr_nonnull(rv);
+	ck_assert_int_eq(len, 0);
+
 	rv = oidc_util_base64_decode(oidc_test_pool_get(), input, &output, &len);
 	ck_assert_msg(rv == NULL, "return value is not NULL");
 	ck_assert_int_eq(len, 4);
@@ -78,12 +94,13 @@ END_TEST
 
 START_TEST(test_util_base64url_decode) {
 	int len = -1;
-	char *src = "dGVzdA==";
+	char *src = "c3ViamVjdHM_X2Q9MQ-Tl5u,";
 	char *dst = NULL;
 	len = oidc_util_base64url_decode(oidc_test_pool_get(), &dst, src);
 	ck_assert_msg(dst != NULL, "dst value is NULL");
-	ck_assert_int_eq(len, 4);
-	ck_assert_str_eq(dst, "test");
+	ck_assert_int_eq(len, 17);
+	// TODO: need binary compare
+	// ck_assert_str_eq(dst, "subjects?_d=1���");
 }
 END_TEST