FromBase64 string length must be multiple or 4 or not?

Question

according to my understanding, a base64 encoded string (ie the output of encode) must always be a multiple of 4.

the c# Convert.FromBase64String says that its input must be a multiple of 4

However if I give it a 25 character string it doesnt complain

[convert]::FromBase64String("ei5gsIELIki+GpnPGyPVBA==")
[convert]::FromBase64String("1ei5gsIELIki+GpnPGyPVBA==")

both work. (The first one is 24 , second is 25)

[convert]::FromBase64String("11ei5gsIELIki+GpnPGyPVBA==")

fails with Invalid length exception

I assume this is a bug in the c# library but I just want to make sure - I am writing code that is sniffing strings to see if they are valid base64 strings and I want to be sure that I understand what a valid one looks like (one possible implementation was to give the string to system.convert and see if it threw - why reinvent perfectly good code)

Answer 1

Yes, this is a flaw (aka bug). It got started due to a perf optimization in an internal helper function named FromBase64_ComputeResultLength() which calculates the length of the byte[] result. It has this comment (edited to fit):

   // For legal input, we can assume that 0 <= padding < 3. But it may be 
   // more for illegal input.
   // We will notice it at decode when we see a '=' at the wrong place.

The "we will notice" remark is not entirely accurate, the decoder does flag an '=' if one isn't expected but it fails to check if there's one too many. Which is the case for the 25-char string.

You can report the problem at connect.microsoft.com, I don't see an existing report that resembles it. Do note that it is fairly unlikely that Microsoft can actually fix it any time soon since the change is going to break existing programs that now successfully parse bad base64 strings. It normally requires a major .NET release update to get rid of such problems, like it was done for .NET 4.0, there isn't one on the horizon afaik.

But yes, the simple workaround for you is to check if the string length is divisible by 4, use the % operator.