Uh oh!
There was an error while loading. Please reload this page.
#124513 - Guard Base64Url.DecodeFromChars against non-ASCII input - #124540
Merged
Conversation
dotnet#124513 - Guard Base64Url.DecodeFromChars against non-ASCII input Base64Url.DecodeFromChars in Microsoft.Bcl.Memory has an out-of-bounds read bug: DecodeFrom uses Unsafe.Add with raw char values as indices into a 256-element DecodingMap without checking the DecodeRemaining return value first. Non-ASCII chars (value > ~2048) cause an AccessViolationException on .NET 8. Workaround: Add System.Text.Ascii.IsValid check before decoding to reject non-ASCII input early. Base64/Base64Url only uses ASCII characters, so any non-ASCII input is inherently invalid. See: dotnet#124513
Contributor
Tagging subscribers to this area: @dotnet/area-system-buffers |
This was referenced Feb 18, 2026
Open
lilinus
reviewed
Feb 18, 2026
Uh oh!
There was an error while loading. Please reload this page.
jeffhandley
approved these changes
Feb 19, 2026
Uh oh!
There was an error while loading. Please reload this page.
GrabYourPitchforks
approved these changes
Feb 19, 2026
GrabYourPitchforks
left a comment
Member
There was a problem hiding this comment.
LGTM. We can investigate the BOM issue afterward.
tannergooding
enabled auto-merge (squash)
February 19, 2026 01:44
jeffhandley
commented
Feb 19, 2026
Member
/ba-g Unrelated networking failures on Android only |
Uh oh!
There was an error while loading. Please reload this page.
BrennanConroy added a commit
to BrennanConroy/runtime
that referenced
this pull request
Feb 27, 2026
…SCII input (dotnet#124540)" This reverts commit 1451f24.
iremyux pushed a commit
to iremyux/dotnet-runtime
that referenced
this pull request
Mar 2, 2026
…ut (dotnet#124540) Base64Url.DecodeFromChars in Microsoft.Bcl.Memory has an out-of-bounds read bug: DecodeFrom uses Unsafe.Add with raw char values as indices into a 256-element DecodingMap without checking the DecodeRemaining return value first. Non-ASCII chars (value > ~2048) cause an AccessViolationException on .NET 8. Workaround: Add System.Text.Ascii.IsValid check before decoding to reject non-ASCII input early. Base64/Base64Url only uses ASCII characters, so any non-ASCII input is inherently invalid. Fixesdotnet#124513 --------- Co-authored-by: t.csala <t.csala@criteo.com>
dotnet-bot pushed a commit
that referenced
this pull request
Mar 10, 2026
…24540) Base64Url.DecodeFromChars in Microsoft.Bcl.Memory has an out-of-bounds read bug: DecodeFrom uses Unsafe.Add with raw char values as indices into a 256-element DecodingMap without checking the DecodeRemaining return value first. Non-ASCII chars (value > ~2048) cause an AccessViolationException on .NET 8. Workaround: Add System.Text.Ascii.IsValid check before decoding to reject non-ASCII input early. Base64/Base64Url only uses ASCII characters, so any non-ASCII input is inherently invalid. Fixes#124513 --------- Co-authored-by: t.csala <t.csala@criteo.com>
dotnet-bot pushed a commit
that referenced
this pull request
Mar 10, 2026
…24540) Base64Url.DecodeFromChars in Microsoft.Bcl.Memory has an out-of-bounds read bug: DecodeFrom uses Unsafe.Add with raw char values as indices into a 256-element DecodingMap without checking the DecodeRemaining return value first. Non-ASCII chars (value > ~2048) cause an AccessViolationException on .NET 8. Workaround: Add System.Text.Ascii.IsValid check before decoding to reject non-ASCII input early. Base64/Base64Url only uses ASCII characters, so any non-ASCII input is inherently invalid. Fixes#124513 --------- Co-authored-by: t.csala <t.csala@criteo.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Base64Url.DecodeFromChars in Microsoft.Bcl.Memory has an out-of-bounds read bug: DecodeFrom uses Unsafe.Add with raw char values as indices into a 256-element DecodingMap without checking the DecodeRemaining return value first. Non-ASCII chars (value > ~2048) cause an AccessViolationException on .NET 8.
Workaround: Add System.Text.Ascii.IsValid check before decoding to reject non-ASCII input early. Base64/Base64Url only uses ASCII characters, so any non-ASCII input is inherently invalid.
Fixes#124513