From 1aa6f1af8150eb69058c67165bfd816b2ebf6b64 Mon Sep 17 00:00:00 2001
From: "andrey.bychkov" <andrey@signalmodelling.ru>
Date: Thu, 6 Aug 2026 10:19:13 +0300
Subject: [PATCH] fix(PIByteArray): prevent OOB in fromBase64 with
 non-multiple-of-4 input

The buffer was sized as floor(sz/4)*3 but the loop ran ceil(sz/4)
times, writing 3 bytes per iteration. For sz%4!=0, this wrote past
the buffer end. Also guarded sz<4 to avoid processing trivially
short or malformed input.
---
 libs/main/types/pibytearray.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/libs/main/types/pibytearray.cpp b/libs/main/types/pibytearray.cpp
index f3c5359d..7d064d40 100644
--- a/libs/main/types/pibytearray.cpp
+++ b/libs/main/types/pibytearray.cpp
@@ -198,10 +198,11 @@ PIByteArray PIByteArray::fromBase64(const PIByteArray & base64) {
 	base64HelpStruct hs;
 	PIByteArray ret;
 	const int sz = base64.size_s();
-	int ind      = -1;
+	if (sz < 4) return PIByteArray();
+	int ind = -1;
 	uchar t[4];
 	ret.resize(sz / 4 * 3);
-	for (int i = 0; i < sz; i += 4) {
+	for (int i = 0; i < sz / 4 * 4; i += 4) {
 		hs.setAscii(base64.data(i));
 		hs.getBytes(t);
 		ret[++ind] = (t[0]);