cisco / libest

Other
97 stars 94 forks source link

b64_decode_cacerts: accept non-wrapped input #114

Open frasertweedale opened 2 years ago

frasertweedale commented 2 years ago

BIO_f_base64 either requires wrapped base64 with a short initial line, or when BIO_FLAGS_BASE64_NO_NL is set, all data must be on a single line (with or without trailing newline character). See BIO_f_base64(3ossl) for more details.

RFC 8951 (an update to RFC 7030) clarifies that senders are not required to insert white space (such as LF) in base64-encoded payloads. Therefore libest must handle wrapped or unwrapped base64 with lines of any length.

This leaves two options:

  1. set BIO_FLAGS_BASE64_NO_NL and unwrap the input lines

  2. leave the flag unset but split long lines and ensure the input ends with a newline.

Option 1 is simpler so that's what this commit implements.