lib/base64.c

   1 /* base64.c -- Encode binary data using printable characters.
   2    Copyright (C) 1999-2001, 2004-2006, 2009-2024 Free Software Foundation, Inc.
   3
   4    This file is free software: you can redistribute it and/or modify
   5    it under the terms of the GNU Lesser General Public License as
   6    published by the Free Software Foundation; either version 2.1 of the
   7    License, or (at your option) any later version.
   8
   9    This file is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU Lesser General Public License for more details.
  13
  14    You should have received a copy of the GNU Lesser General Public License
  15    along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
  16
  17 /* Written by Simon Josefsson.  Partially adapted from GNU MailUtils
  18  * (mailbox/filter_trans.c, as of 2004-11-28).  Improved by review
  19  * from Paul Eggert, Bruno Haible, and Stepan Kasal.
  20  *
  21  * See also RFC 4648 <https://www.ietf.org/rfc/rfc4648.txt>.
  22  *
  23  * Be careful with error checking.  Here is how you would typically
  24  * use these functions:
  25  *
  26  * bool ok = base64_decode_alloc (in, inlen, &out, &outlen);
  27  * if (!ok)
  28  *   FAIL: input was not valid base64
  29  * if (out == NULL)
  30  *   FAIL: memory allocation error
  31  * OK: data in OUT/OUTLEN
  32  *
  33  * idx_t outlen = base64_encode_alloc (in, inlen, &out);
  34  * if (out == NULL && outlen == 0 && inlen != 0)
  35  *   FAIL: input too long
  36  * if (out == NULL)
  37  *   FAIL: memory allocation error
  38  * OK: data in OUT/OUTLEN.
  39  *
  40  */
  41
  42 #include <config.h>
  43
  44 /* Get prototype. */
  45 #define BASE64_INLINE _GL_EXTERN_INLINE
  46 #include "base64.h"
  47
  48 /* Get imalloc. */
  49 #include <ialloc.h>
  50
  51 #include <intprops.h>
  52
  53 #include <string.h>
  54
  55 /* Convert 'char' to 'unsigned char' without casting.  */
  56 static unsigned char
  57 to_uchar (char ch)
  58 {
  59   return ch;
  60 }
  61
  62 static const char b64c[64] =
  63   "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
  64
  65 /* Base64 encode IN array of size INLEN into OUT array. OUT needs
  66    to be of length >= BASE64_LENGTH(INLEN), and INLEN needs to be
  67    a multiple of 3.  */
  68 static void
  69 base64_encode_fast (const char *restrict in, idx_t inlen, char *restrict out)
  70 {
  71   while (inlen)
  72     {
  73       *out++ = b64c[(to_uchar (in[0]) >> 2) & 0x3f];
  74       *out++ = b64c[((to_uchar (in[0]) << 4) + (to_uchar (in[1]) >> 4)) & 0x3f];
  75       *out++ = b64c[((to_uchar (in[1]) << 2) + (to_uchar (in[2]) >> 6)) & 0x3f];
  76       *out++ = b64c[to_uchar (in[2]) & 0x3f];
  77
  78       inlen -= 3;
  79       in += 3;
  80     }
  81 }
  82
  83 /* Base64 encode IN array of size INLEN into OUT array of size OUTLEN.
  84    If OUTLEN is less than BASE64_LENGTH(INLEN), write as many bytes as
  85    possible.  If OUTLEN is larger than BASE64_LENGTH(INLEN), also zero
  86    terminate the output buffer. */
  87 void
  88 base64_encode (const char *restrict in, idx_t inlen,
  89                char *restrict out, idx_t outlen)
  90 {
  91   /* Note this outlen constraint can be enforced at compile time.
  92      I.E. that the output buffer is exactly large enough to hold
  93      the encoded inlen bytes.  The inlen constraints (of corresponding
  94      to outlen, and being a multiple of 3) can change at runtime
  95      at the end of input.  However the common case when reading
  96      large inputs is to have both constraints satisfied, so we depend
  97      on both in base_encode_fast().  */
  98   if (outlen % 4 == 0 && inlen == (outlen >> 2) * 3)
  99     {
 100       base64_encode_fast (in, inlen, out);
 101       return;
 102     }
 103
 104   while (inlen && outlen)
 105     {
 106       *out++ = b64c[(to_uchar (in[0]) >> 2) & 0x3f];
 107       if (!--outlen)
 108         break;
 109       *out++ = b64c[((to_uchar (in[0]) << 4)
 110                        + (--inlen ? to_uchar (in[1]) >> 4 : 0))
 111                       & 0x3f];
 112       if (!--outlen)
 113         break;
 114       *out++ =
 115         (inlen
 116          ? b64c[((to_uchar (in[1]) << 2)
 117                    + (--inlen ? to_uchar (in[2]) >> 6 : 0))
 118                   & 0x3f]
 119          : '=');
 120       if (!--outlen)
 121         break;
 122       *out++ = inlen ? b64c[to_uchar (in[2]) & 0x3f] : '=';
 123       if (!--outlen)
 124         break;
 125       if (inlen)
 126         inlen--;
 127       if (inlen)
 128         in += 3;
 129     }
 130
 131   if (outlen)
 132     *out = '\0';
 133 }
 134
 135 /* Allocate a buffer and store zero terminated base64 encoded data
 136    from array IN of size INLEN, returning BASE64_LENGTH(INLEN), i.e.,
 137    the length of the encoded data, excluding the terminating zero.  On
 138    return, the OUT variable will hold a pointer to newly allocated
 139    memory that must be deallocated by the caller.  If output string
 140    length would overflow, 0 is returned and OUT is set to NULL.  If
 141    memory allocation failed, OUT is set to NULL, and the return value
 142    indicates length of the requested memory block, i.e.,
 143    BASE64_LENGTH(inlen) + 1. */
 144 idx_t
 145 base64_encode_alloc (const char *in, idx_t inlen, char **out)
 146 {
 147   /* Check for overflow in outlen computation.
 148      Treat negative INLEN as overflow, for better compatibility with
 149      pre-2021-08-27 API, which used size_t.  */
 150   idx_t in_over_3 = inlen / 3 + (inlen % 3 != 0), outlen;
 151   if (! INT_MULTIPLY_OK (in_over_3, 4, &outlen) || inlen < 0)
 152     {
 153       *out = NULL;
 154       return 0;
 155     }
 156   outlen++;
 157
 158   *out = imalloc (outlen);
 159   if (!*out)
 160     return outlen;
 161
 162   base64_encode (in, inlen, *out, outlen);
 163
 164   return outlen - 1;
 165 }
 166
 167 /* With this approach this file works independent of the charset used
 168    (think EBCDIC).  However, it does assume that the characters in the
 169    Base64 alphabet (A-Za-z0-9+/) are encoded in 0..255.  POSIX
 170    1003.1-2001 require that char and unsigned char are 8-bit
 171    quantities, though, taking care of that problem.  But this may be a
 172    potential problem on non-POSIX C99 platforms.
 173
 174    IBM C V6 for AIX mishandles "#define B64(x) ...'x'...", so use "_"
 175    as the formal parameter rather than "x".  */
 176 #define B64(_)                                  \
 177   ((_) == 'A' ? 0                               \
 178    : (_) == 'B' ? 1                             \
 179    : (_) == 'C' ? 2                             \
 180    : (_) == 'D' ? 3                             \
 181    : (_) == 'E' ? 4                             \
 182    : (_) == 'F' ? 5                             \
 183    : (_) == 'G' ? 6                             \
 184    : (_) == 'H' ? 7                             \
 185    : (_) == 'I' ? 8                             \
 186    : (_) == 'J' ? 9                             \
 187    : (_) == 'K' ? 10                            \
 188    : (_) == 'L' ? 11                            \
 189    : (_) == 'M' ? 12                            \
 190    : (_) == 'N' ? 13                            \
 191    : (_) == 'O' ? 14                            \
 192    : (_) == 'P' ? 15                            \
 193    : (_) == 'Q' ? 16                            \
 194    : (_) == 'R' ? 17                            \
 195    : (_) == 'S' ? 18                            \
 196    : (_) == 'T' ? 19                            \
 197    : (_) == 'U' ? 20                            \
 198    : (_) == 'V' ? 21                            \
 199    : (_) == 'W' ? 22                            \
 200    : (_) == 'X' ? 23                            \
 201    : (_) == 'Y' ? 24                            \
 202    : (_) == 'Z' ? 25                            \
 203    : (_) == 'a' ? 26                            \
 204    : (_) == 'b' ? 27                            \
 205    : (_) == 'c' ? 28                            \
 206    : (_) == 'd' ? 29                            \
 207    : (_) == 'e' ? 30                            \
 208    : (_) == 'f' ? 31                            \
 209    : (_) == 'g' ? 32                            \
 210    : (_) == 'h' ? 33                            \
 211    : (_) == 'i' ? 34                            \
 212    : (_) == 'j' ? 35                            \
 213    : (_) == 'k' ? 36                            \
 214    : (_) == 'l' ? 37                            \
 215    : (_) == 'm' ? 38                            \
 216    : (_) == 'n' ? 39                            \
 217    : (_) == 'o' ? 40                            \
 218    : (_) == 'p' ? 41                            \
 219    : (_) == 'q' ? 42                            \
 220    : (_) == 'r' ? 43                            \
 221    : (_) == 's' ? 44                            \
 222    : (_) == 't' ? 45                            \
 223    : (_) == 'u' ? 46                            \
 224    : (_) == 'v' ? 47                            \
 225    : (_) == 'w' ? 48                            \
 226    : (_) == 'x' ? 49                            \
 227    : (_) == 'y' ? 50                            \
 228    : (_) == 'z' ? 51                            \
 229    : (_) == '0' ? 52                            \
 230    : (_) == '1' ? 53                            \
 231    : (_) == '2' ? 54                            \
 232    : (_) == '3' ? 55                            \
 233    : (_) == '4' ? 56                            \
 234    : (_) == '5' ? 57                            \
 235    : (_) == '6' ? 58                            \
 236    : (_) == '7' ? 59                            \
 237    : (_) == '8' ? 60                            \
 238    : (_) == '9' ? 61                            \
 239    : (_) == '+' ? 62                            \
 240    : (_) == '/' ? 63                            \
 241    : -1)
 242
 243 signed char const base64_to_int[256] = {
 244   B64 (0), B64 (1), B64 (2), B64 (3),
 245   B64 (4), B64 (5), B64 (6), B64 (7),
 246   B64 (8), B64 (9), B64 (10), B64 (11),
 247   B64 (12), B64 (13), B64 (14), B64 (15),
 248   B64 (16), B64 (17), B64 (18), B64 (19),
 249   B64 (20), B64 (21), B64 (22), B64 (23),
 250   B64 (24), B64 (25), B64 (26), B64 (27),
 251   B64 (28), B64 (29), B64 (30), B64 (31),
 252   B64 (32), B64 (33), B64 (34), B64 (35),
 253   B64 (36), B64 (37), B64 (38), B64 (39),
 254   B64 (40), B64 (41), B64 (42), B64 (43),
 255   B64 (44), B64 (45), B64 (46), B64 (47),
 256   B64 (48), B64 (49), B64 (50), B64 (51),
 257   B64 (52), B64 (53), B64 (54), B64 (55),
 258   B64 (56), B64 (57), B64 (58), B64 (59),
 259   B64 (60), B64 (61), B64 (62), B64 (63),
 260   B64 (64), B64 (65), B64 (66), B64 (67),
 261   B64 (68), B64 (69), B64 (70), B64 (71),
 262   B64 (72), B64 (73), B64 (74), B64 (75),
 263   B64 (76), B64 (77), B64 (78), B64 (79),
 264   B64 (80), B64 (81), B64 (82), B64 (83),
 265   B64 (84), B64 (85), B64 (86), B64 (87),
 266   B64 (88), B64 (89), B64 (90), B64 (91),
 267   B64 (92), B64 (93), B64 (94), B64 (95),
 268   B64 (96), B64 (97), B64 (98), B64 (99),
 269   B64 (100), B64 (101), B64 (102), B64 (103),
 270   B64 (104), B64 (105), B64 (106), B64 (107),
 271   B64 (108), B64 (109), B64 (110), B64 (111),
 272   B64 (112), B64 (113), B64 (114), B64 (115),
 273   B64 (116), B64 (117), B64 (118), B64 (119),
 274   B64 (120), B64 (121), B64 (122), B64 (123),
 275   B64 (124), B64 (125), B64 (126), B64 (127),
 276   B64 (128), B64 (129), B64 (130), B64 (131),
 277   B64 (132), B64 (133), B64 (134), B64 (135),
 278   B64 (136), B64 (137), B64 (138), B64 (139),
 279   B64 (140), B64 (141), B64 (142), B64 (143),
 280   B64 (144), B64 (145), B64 (146), B64 (147),
 281   B64 (148), B64 (149), B64 (150), B64 (151),
 282   B64 (152), B64 (153), B64 (154), B64 (155),
 283   B64 (156), B64 (157), B64 (158), B64 (159),
 284   B64 (160), B64 (161), B64 (162), B64 (163),
 285   B64 (164), B64 (165), B64 (166), B64 (167),
 286   B64 (168), B64 (169), B64 (170), B64 (171),
 287   B64 (172), B64 (173), B64 (174), B64 (175),
 288   B64 (176), B64 (177), B64 (178), B64 (179),
 289   B64 (180), B64 (181), B64 (182), B64 (183),
 290   B64 (184), B64 (185), B64 (186), B64 (187),
 291   B64 (188), B64 (189), B64 (190), B64 (191),
 292   B64 (192), B64 (193), B64 (194), B64 (195),
 293   B64 (196), B64 (197), B64 (198), B64 (199),
 294   B64 (200), B64 (201), B64 (202), B64 (203),
 295   B64 (204), B64 (205), B64 (206), B64 (207),
 296   B64 (208), B64 (209), B64 (210), B64 (211),
 297   B64 (212), B64 (213), B64 (214), B64 (215),
 298   B64 (216), B64 (217), B64 (218), B64 (219),
 299   B64 (220), B64 (221), B64 (222), B64 (223),
 300   B64 (224), B64 (225), B64 (226), B64 (227),
 301   B64 (228), B64 (229), B64 (230), B64 (231),
 302   B64 (232), B64 (233), B64 (234), B64 (235),
 303   B64 (236), B64 (237), B64 (238), B64 (239),
 304   B64 (240), B64 (241), B64 (242), B64 (243),
 305   B64 (244), B64 (245), B64 (246), B64 (247),
 306   B64 (248), B64 (249), B64 (250), B64 (251),
 307   B64 (252), B64 (253), B64 (254), B64 (255)
 308 };
 309
 310 /* If CTX->i is 0 or 4, there are four or more bytes in [*IN..IN_END), and
 311    none of those four is a newline, then return *IN.  Otherwise, copy up to
 312    4 - CTX->i non-newline bytes from that range into CTX->buf, starting at
 313    index CTX->i and setting CTX->i to reflect the number of bytes copied,
 314    and return CTX->buf.  In either case, advance *IN to point to the byte
 315    after the last one processed, and set *N_NON_NEWLINE to the number of
 316    verified non-newline bytes accessible through the returned pointer.  */
 317 static char *
 318 get_4 (struct base64_decode_context *ctx,
 319        char const *restrict *in, char const *restrict in_end,
 320        idx_t *n_non_newline)
 321 {
 322   if (ctx->i == 4)
 323     ctx->i = 0;
 324
 325   if (ctx->i == 0)
 326     {
 327       char const *t = *in;
 328       if (4 <= in_end - *in && memchr (t, '\n', 4) == NULL)
 329         {
 330           /* This is the common case: no newline.  */
 331           *in += 4;
 332           *n_non_newline = 4;
 333           return (char *) t;
 334         }
 335     }
 336
 337   {
 338     /* Copy non-newline bytes into BUF.  */
 339     char const *p = *in;
 340     while (p < in_end)
 341       {
 342         char c = *p++;
 343         if (c != '\n')
 344           {
 345             ctx->buf[ctx->i++] = c;
 346             if (ctx->i == 4)
 347               break;
 348           }
 349       }
 350
 351     *in = p;
 352     *n_non_newline = ctx->i;
 353     return ctx->buf;
 354   }
 355 }
 356
 357 #define return_false                            \
 358   do                                            \
 359     {                                           \
 360       *outp = out;                              \
 361       return false;                             \
 362     }                                           \
 363   while (false)
 364
 365 /* Decode up to four bytes of base64-encoded data, IN, of length INLEN
 366    into the output buffer, *OUT, of size *OUTLEN bytes.  Return true if
 367    decoding is successful, false otherwise.  If *OUTLEN is too small,
 368    as many bytes as possible are written to *OUT.  On return, advance
 369    *OUT to point to the byte after the last one written, and decrement
 370    *OUTLEN to reflect the number of bytes remaining in *OUT.  */
 371 static bool
 372 decode_4 (char const *restrict in, idx_t inlen,
 373           char *restrict *outp, idx_t *outleft)
 374 {
 375   char *out = *outp;
 376   if (inlen < 2)
 377     return false;
 378
 379   if (!isbase64 (in[0]) || !isbase64 (in[1]))
 380     return false;
 381
 382   if (*outleft)
 383     {
 384       *out++ = ((base64_to_int[to_uchar (in[0])] << 2)
 385                 | (base64_to_int[to_uchar (in[1])] >> 4));
 386       --*outleft;
 387     }
 388
 389   if (inlen == 2)
 390     return_false;
 391
 392   if (in[2] == '=')
 393     {
 394       if (inlen != 4)
 395         return_false;
 396
 397       if (in[3] != '=')
 398         return_false;
 399
 400       /* Reject non-canonical encodings.  */
 401       if (base64_to_int[to_uchar (in[1])] & 0x0f)
 402         return_false;
 403     }
 404   else
 405     {
 406       if (!isbase64 (in[2]))
 407         return_false;
 408
 409       if (*outleft)
 410         {
 411           *out++ = (((base64_to_int[to_uchar (in[1])] << 4) & 0xf0)
 412                     | (base64_to_int[to_uchar (in[2])] >> 2));
 413           --*outleft;
 414         }
 415
 416       if (inlen == 3)
 417         return_false;
 418
 419       if (in[3] == '=')
 420         {
 421           if (inlen != 4)
 422             return_false;
 423
 424           /* Reject non-canonical encodings.  */
 425           if (base64_to_int[to_uchar (in[2])] & 0x03)
 426             return_false;
 427         }
 428       else
 429         {
 430           if (!isbase64 (in[3]))
 431             return_false;
 432
 433           if (*outleft)
 434             {
 435               *out++ = (((base64_to_int[to_uchar (in[2])] << 6) & 0xc0)
 436                         | base64_to_int[to_uchar (in[3])]);
 437               --*outleft;
 438             }
 439         }
 440     }
 441
 442   *outp = out;
 443   return true;
 444 }
 445
 446 /* Decode base64-encoded input array IN of length INLEN to output array
 447    OUT that can hold *OUTLEN bytes.  The input data may be interspersed
 448    with newlines.  Return true if decoding was successful, i.e. if the
 449    input was valid base64 data, false otherwise.  If *OUTLEN is too
 450    small, as many bytes as possible will be written to OUT.  On return,
 451    *OUTLEN holds the length of decoded bytes in OUT.  Note that as soon
 452    as any non-alphabet, non-newline character is encountered, decoding
 453    is stopped and false is returned.  If INLEN is zero, then process
 454    only whatever data is stored in CTX.
 455
 456    Initially, CTX must have been initialized via base64_decode_ctx_init.
 457    Subsequent calls to this function must reuse whatever state is recorded
 458    in that buffer.  It is necessary for when a quadruple of base64 input
 459    bytes spans two input buffers.
 460
 461    If CTX is NULL then newlines are treated as garbage and the input
 462    buffer is processed as a unit.  */
 463
 464 bool
 465 base64_decode_ctx (struct base64_decode_context *ctx,
 466                    const char *restrict in, idx_t inlen,
 467                    char *restrict out, idx_t *outlen)
 468 {
 469   idx_t outleft = *outlen;
 470   bool ignore_newlines = ctx != NULL;
 471   bool flush_ctx = false;
 472   unsigned int ctx_i = 0;
 473
 474   if (ignore_newlines)
 475     {
 476       ctx_i = ctx->i;
 477       flush_ctx = inlen == 0;
 478     }
 479
 480
 481   while (true)
 482     {
 483       idx_t outleft_save = outleft;
 484       if (ctx_i == 0 && !flush_ctx)
 485         {
 486           while (true)
 487             {
 488               /* Save a copy of outleft, in case we need to re-parse this
 489                  block of four bytes.  */
 490               outleft_save = outleft;
 491               if (!decode_4 (in, inlen, &out, &outleft))
 492                 break;
 493
 494               in += 4;
 495               inlen -= 4;
 496             }
 497         }
 498
 499       if (inlen == 0 && !flush_ctx)
 500         break;
 501
 502       /* Handle the common case of 72-byte wrapped lines.
 503          This also handles any other multiple-of-4-byte wrapping.  */
 504       if (inlen && *in == '\n' && ignore_newlines)
 505         {
 506           ++in;
 507           --inlen;
 508           continue;
 509         }
 510
 511       /* Restore OUT and OUTLEFT.  */
 512       out -= outleft_save - outleft;
 513       outleft = outleft_save;
 514
 515       {
 516         char const *in_end = in + inlen;
 517         char const *non_nl;
 518
 519         if (ignore_newlines)
 520           non_nl = get_4 (ctx, &in, in_end, &inlen);
 521         else
 522           non_nl = in;  /* Might have nl in this case. */
 523
 524         /* If the input is empty or consists solely of newlines (0 non-newlines),
 525            then we're done.  Likewise if there are fewer than 4 bytes when not
 526            flushing context and not treating newlines as garbage.  */
 527         if (inlen == 0 || (inlen < 4 && !flush_ctx && ignore_newlines))
 528           {
 529             inlen = 0;
 530             break;
 531           }
 532         if (!decode_4 (non_nl, inlen, &out, &outleft))
 533           break;
 534
 535         inlen = in_end - in;
 536       }
 537     }
 538
 539   *outlen -= outleft;
 540
 541   return inlen == 0;
 542 }
 543
 544 /* Allocate an output buffer in *OUT, and decode the base64 encoded
 545    data stored in IN of size INLEN to the *OUT buffer.  On return, the
 546    size of the decoded data is stored in *OUTLEN.  OUTLEN may be NULL,
 547    if the caller is not interested in the decoded length.  *OUT may be
 548    NULL to indicate an out of memory error, in which case *OUTLEN
 549    contains the size of the memory block needed.  The function returns
 550    true on successful decoding and memory allocation errors.  (Use the
 551    *OUT and *OUTLEN parameters to differentiate between successful
 552    decoding and memory error.)  The function returns false if the
 553    input was invalid, in which case *OUT is NULL and *OUTLEN is
 554    undefined. */
 555 bool
 556 base64_decode_alloc_ctx (struct base64_decode_context *ctx,
 557                          const char *in, idx_t inlen, char **out,
 558                          idx_t *outlen)
 559 {
 560   /* This may allocate a few bytes too many, depending on input,
 561      but it's not worth the extra CPU time to compute the exact size.
 562      The exact size is 3 * (inlen + (ctx ? ctx->i : 0)) / 4, minus 1 if the
 563      input ends with "=" and minus another 1 if the input ends with "==".
 564      Shifting before multiplying avoids the possibility of overflow.  */
 565   idx_t needlen = 3 * ((inlen >> 2) + 1);
 566
 567   *out = imalloc (needlen);
 568   if (!*out)
 569     return true;
 570
 571   if (!base64_decode_ctx (ctx, in, inlen, *out, &needlen))
 572     {
 573       free (*out);
 574       *out = NULL;
 575       return false;
 576     }
 577
 578   if (outlen)
 579     *outlen = needlen;
 580
 581   return true;
 582 }