{"record":{"id":"5ed31ddaa6135c16","repo":"NationalSecurityAgency/ghidra","slug":"bad-base64-encoding","errorCode":null,"errorMessage":"Bad base64 encoding","messagePattern":"Bad base64 encoding","errorType":"exception","errorClass":"NumberFormatException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/Base64Lite.java","lineNumber":114,"sourceCode":"    \t\telse {\n    \t\t\tbuffer[pos++] = encode[chunk];\n    \t\t\tseenNonZero = true;\n    \t\t}\n    \t}\n    \treturn new String(buffer,0,pos);\n    }\n\n    /**\n     * Decode (up to 11) base64 characters to produce a long\n     * @param val is the String to decode\n     * @return the decode long\n     */\n    public static long decodeLongBase64(String val) {\n    \tlong res = 0;\n    \tfor(int i=0;i<val.length();++i) {\n    \t\tint chunk = decode[val.charAt(i)];\n    \t\tif (chunk < 0)\n    \t\t\tthrow new NumberFormatException(\"Bad base64 encoding\");\n    \t\tres <<= 6;\n    \t\tres |= chunk;\n    \t}\n    \treturn res;\n    }\n}\n","sourceCodeStart":96,"sourceCodeEnd":121,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/Base64Lite.java#L96-L121","documentation":"Thrown by Base64Lite.decodeLongBase64 when a character in the input string maps to a negative value in the decode table, i.e. it is not one of the 64 valid RFC-4648 URL/filename-safe characters (A-Z, a-z, 0-9, '-', '_'). It is an unchecked NumberFormatException. This is the BSim-internal base64 used for compact long encodings (e.g. signature ids), not standard MIME base64.","triggerScenarios":"Calling decodeLongBase64(val) with a string containing standard base64 characters like '+' or '/', whitespace, '=' padding, or any char outside the 0-127 ASCII range / not in the encode alphabet. Reached when decoding stored signature/hash longs from an elastic or XML source.","commonSituations":"Data encoded with a standard (MIME) base64 encoder instead of Base64Lite; '+' or '/' characters present; stray whitespace/newlines or '=' padding not stripped; truncated or corrupted field; mixing Base64Lite output with another base64 variant.","solutions":["Ensure the value was produced by Base64Lite.encodeLongBase64 (URL-safe alphabet, no padding).","Strip whitespace/newlines and remove any '=' padding before decoding.","If the source is standard base64, translate '+'->'-' and '/'->'_' before passing to decodeLongBase64.","Limit input to <=11 characters and verify every char is in the URL-safe alphabet."],"exampleFix":"// before\nlong v = Base64Lite.decodeLongBase64(s); // throws on '+' / '/' / '='\n\n// after\nString safe = s.replace('+', '-').replace('/', '_').replaceAll(\"[=\\\\s]\", \"\");\nlong v = Base64Lite.decodeLongBase64(safe);","handlingStrategy":"validation","validationCode":"private static final String SAFE = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\";\nboolean isBase64Lite(String s) {\n    for (int i = 0; i < s.length(); i++) if (SAFE.indexOf(s.charAt(i)) < 0) return false;\n    return s.length() <= 11;\n}\nif (!isBase64Lite(val)) throw new NumberFormatException(\"not Base64Lite: \" + val);\nlong v = Base64Lite.decodeLongBase64(val);","typeGuard":"boolean isBase64LiteSafe(String s) {\n    if (s == null || s.length() > 11) return false;\n    for (int i = 0; i < s.length(); i++) {\n        char c = s.charAt(i);\n        if (!((c >= 'A' && c <= 'Z') || (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c == '-' || c == '_')) return false;\n    }\n    return true;\n}","tryCatchPattern":"try {\n    return Base64Lite.decodeLongBase64(val);\n} catch (NumberFormatException e) {\n    String safe = val.replace('+', '-').replace('/', '_').replaceAll(\"[=\\\\s]\", \"\");\n    return Base64Lite.decodeLongBase64(safe);\n}","preventionTips":["Only decode values produced by Base64Lite.encodeLongBase64.","Strip whitespace/newlines and '=' padding before decoding.","Map '+'->'-' and '/'->'_' if the source uses standard base64."],"tags":["bsim","elastic","base64","encoding","java"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}