* src/basenc.c (base32hex_decode_ctx_wrapper): Ensure we don't
accept base32 only characters for base32hex.
* tests/basenc/basenc.pl: Ensure negative base32hex tests have the
appropriate number of characters to test character validation
rather than just input size validation.
* NEWS: Mention the bug fix.
Discovered by Anthropic's OSS Scanner, as bug ANT-2026-EP1XO2G4.
---
NEWS | 3 +++
src/basenc.c | 2 ++
tests/basenc/basenc.pl | 4 ++--
3 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/NEWS b/NEWS
index 8c4babc18..b315ce7f4 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,9 @@ GNU coreutils NEWS -*-
outline -*-
** Bug fixes
+ 'basenc --base32hex' no longer decodes BASE32 only characters "WXYZ".
+ [bug introduced with the basenc program in coreutils-8.31]
+
'chroot --userspec=USER' now uses the primary group of USER as looked up
inside the chroot. Previously the group looked up outside the chroot
was used, even when the look-up inside the chroot succeeded.
diff --git a/src/basenc.c b/src/basenc.c
index 8aaef0d8b..3ab53b4ca 100644
--- a/src/basenc.c
+++ b/src/basenc.c
@@ -645,6 +645,8 @@ base32hex_decode_ctx_wrapper (struct base_decode_context
*ctx,
{
if (isubase32hex (*in))
*p = base32_hex_to_norm[*in - 0x30];
+ else if (isubase32 (*in))
+ *p = '0'; /* Ensure base32 rejects non hex variant. */
else
*p = *in;
++p;
diff --git a/tests/basenc/basenc.pl b/tests/basenc/basenc.pl
index 3749e8720..e1acc38f9 100755
--- a/tests/basenc/basenc.pl
+++ b/tests/basenc/basenc.pl
@@ -166,9 +166,9 @@ my @Tests =
['b32h_2', '--base32hex -d', {IN=>$base32hex_out}, {OUT=>$base32_in}],
['b32h_3', '--base32hex -d -i', {IN=>'/'.$base32hex_out}, {OUT=>$base32_in}],
['b32h_4', '--base32hex -d -i', {IN=>'W'.$base32hex_out}, {OUT=>$base32_in}],
- ['b32h_5', '--base32hex -d', {IN=>$base32hex_out.'W'}, , {OUT=>$base32_in},
+ ['b32h_5', '--base32hex -d',
{IN=>$base32hex_out.'WXYZW'},{OUT=>$base32_in},
{EXIT=>1}, {ERR=>"$prog: invalid input\n"}],
- ['b32h_6', '--base32hex -d', {IN=>$base32hex_out.'/'}, {OUT=>$base32_in},
+ ['b32h_6', '--base32hex -d',
{IN=>$base32hex_out.'/////'},{OUT=>$base32_in},
{EXIT=>1}, {ERR=>"$prog: invalid input\n"}],
['b32h_7', '--base32hex', {IN=>$base32_in2},
{OUT=>$base32hex_out2}],
['b32h_8', '--base32hex -d', {IN=>$base32hex_out2},
{OUT=>$base32_in2}],
--
2.55.0
