Check for valid base64 before decoding (#9904)

diff --git a/doc/lua_api.txt b/doc/lua_api.txt
index 0101bd4cf597b41987ee4613f99577c7fcc2c774..bd0cb8acbf62468f18edc910b91a6b0d54844fb1 100644 (file)
--- a/doc/lua_api.txt
+++ b/doc/lua_api.txt
@@ -5449,7 +5449,7 @@ Misc.
     * Example: `minetest.rgba(10, 20, 30, 40)`, returns `"#0A141E28"`
 * `minetest.encode_base64(string)`: returns string encoded in base64
     * Encodes a string in base64.
-* `minetest.decode_base64(string)`: returns string
+* `minetest.decode_base64(string)`: returns string or nil for invalid base64
     * Decodes a string encoded in base64.
 * `minetest.is_protected(pos, name)`: returns boolean
     * Returning `true` restricts the player `name` from modifying (i.e. digging,

diff --git a/src/script/lua_api/l_util.cpp b/src/script/lua_api/l_util.cpp
index 28ee39fc8c6c7a4f868efed2f9614eb068e7e36a..cd63e20c2b65c558271bcbb355fa4343a7945d25 100644 (file)
--- a/src/script/lua_api/l_util.cpp
+++ b/src/script/lua_api/l_util.cpp
@@ -318,9 +318,13 @@ int ModApiUtil::l_decode_base64(lua_State *L)
        NO_MAP_LOCK_REQUIRED;
 
        size_t size;
-       const char *data = luaL_checklstring(L, 1, &size);
+       const char *d = luaL_checklstring(L, 1, &size);
+       const std::string data = std::string(d, size);
+
+       if (!base64_is_valid(data))
+               return 0;
 
-       std::string out = base64_decode(std::string(data, size));
+       std::string out = base64_decode(data);
 
        lua_pushlstring(L, out.data(), out.size());
        return 1;