// base64_vuln.c - Vulnerable Base64 decoder
#include <stdio.h>
#include <string.h>
#include <stdint.h>

int base64_decode(const char *in, size_t inlen, char *out, size_t outlen) {
    static const char table[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
    int outpos = 0;
    for (int i=0; i<inlen; i+=4) {
        uint32_t sextet = 0;
        int bytes = 0;
        for (int j=0; j<4; j++) {
            if (i+j >= inlen) break;
            const char *p = strchr(table, in[i+j]);
            if (p) sextet = (sextet << 6) | (p - table);
            else bytes++;
        }
        // No check on outpos exceeding outlen!
        out[outpos++] = (sextet >> 16) & 0xFF;
        if (bytes < 2) out[outpos++] = (sextet >> 8) & 0xFF;
        if (bytes < 1) out[outpos++] = sextet & 0xFF;
    }
    return outpos;
}

int main() {
    char smallbuf[8];
    char *malicious = "AAAA"; // padded, decodes to 3 bytes, but we'll feed a long string
    // Attacker sends very long Base64 string, overflows smallbuf
    base64_decode("QUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFB", 60, smallbuf, 8);
    return 0;
}