2 files changed, 24 insertions, 0 deletions

diff --git a/src/lib/libcrypto/evp/encode.c b/src/lib/libcrypto/evp/encode.c
index 9540a849c9..2268b8d2f2 100644
--- a/src/lib/libcrypto/evp/encode.c
+++ b/src/lib/libcrypto/evp/encode.c
@@ -259,6 +259,12 @@ EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
                         goto end;
                 }
 
+                /* There should not be base64 data after padding. */
+                if (eof && tmp != '=' && tmp != '\r' && tmp != '\n') {
+                        rv = -1;
+                        goto end;
+                }
+
                 /* have we seen a '=' which is 'definitely' the last
                  * input line.  seof will point to the character that
                  * holds it. and eof will hold how many characters to
@@ -269,6 +275,12 @@ EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
                         eof++;
                 }
 
+                /* There should be no more than two padding markers. */
+                if (eof > 2) {
+                        rv = -1;
+                        goto end;
+                }
+
                 if (v == B64_CR) {
                         ln = 0;
                         if (exp_nl)
diff --git a/src/lib/libssl/src/crypto/evp/encode.c b/src/lib/libssl/src/crypto/evp/encode.c
index 9540a849c9..2268b8d2f2 100644
--- a/src/lib/libssl/src/crypto/evp/encode.c
+++ b/src/lib/libssl/src/crypto/evp/encode.c
@@ -259,6 +259,12 @@ EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
                         goto end;
                 }
 
+                /* There should not be base64 data after padding. */
+                if (eof && tmp != '=' && tmp != '\r' && tmp != '\n') {
+                        rv = -1;
+                        goto end;
+                }
+
                 /* have we seen a '=' which is 'definitely' the last
                  * input line.  seof will point to the character that
                  * holds it. and eof will hold how many characters to
@@ -269,6 +275,12 @@ EVP_DecodeUpdate(EVP_ENCODE_CTX *ctx, unsigned char *out, int *outl,
                         eof++;
                 }
 
+                /* There should be no more than two padding markers. */
+                if (eof > 2) {
+                        rv = -1;
+                        goto end;
+                }
+
                 if (v == B64_CR) {
                         ln = 0;
                         if (exp_nl)