/ 
Crypt-Sodium-XS-0.000042
/ Crypt::Sodium::XS::Base64
Security Advisories (1)
CVE-2026-30910 (2026-03-08)

Crypt::Sodium::XS versions through 0.001000 for Perl has potential integer overflows. Combined aead encryption, combined signature creation, and bin2hex functions do not check that output size will be less than SIZE_MAX, which could lead to integer wraparound causing an undersized output buffer. This can cause a crash in bin2hex and encryption algorithms other than aes256gcm. For aes256gcm encryption and signatures, an undersized buffer could lead to buffer overflow. Encountering this issue is unlikely as the message length would need to be very large. For bin2hex the input size would have to be > SIZE_MAX / 2 For aegis encryption the input size would need to be > SIZE_MAX - 32U For other encryption the input size would need to be > SIZE_MAX - 16U For signatures the input size would need to be > SIZE_MAX - 64U

NAME

Crypt::Sodium::XS::Base64 - libsodium base64 functions and constants

SYNOPSIS

use Crypt::Sodium::XS::Base64 ':all';

my $b64 = sodium_bin2base64("foobar");
my $bin = sodium_base642bin($b64);
print "$bin\n";
# foobar
my $orig_b64 = sodium_bin2base64("barfoo", BASE64_VARIANT_ORIGINAL);
print sodium_base642bin($orig_b64);
# barfoo

DESCRIPTION

Provides access to the libsodium-provided base64 functions and constants. IMPROVEME.

NOTE: These functions are not intended for use with sensitive data. Crypt::Sodium::XS::MemVault provides much of the same functionality for use with sensitive data.

FUNCTIONS

Nothing is exported by default. The tag :functions imports all "FUNCTIONS". The tag :all imports everything.

sodium_base642bin

my $bytes = sodium_base642bin($string);

Identical to "decode_base64url" in MIME::Base64. Stops parsing at any invalid base64 bytes. $bytes will be empty if $string could not be validly interpreted as base64 (i.e., if the output would not be a multiple of 8 bits).

Returns the base64 decoded bytes.

sodium_bin2base64

my $string = sodium_bin2base64($bytes);
my $string = sodium_bin2base64($bytes, $variant);

$variant is optional. See "BASE64 CONSTANTS". If not provided, the default is "BASE64_VARIANT_URLSAFE_NO_PADDING".

Identical to "encode_base64url" in MIME::Base64.

Returns the base64 encoded string.

CONSTANTS

Nothing is exported by default. The tag :constants imports all "CONSTANTS". The tag :all imports everything.

BASE64_VARIANT_ORIGINAL

RFC 4648 Base 64 Encoding.

BASE64_VARIANT_ORIGINAL_NO_PADDING

RFC 4648 Base 64 Encoding without = padding.

BASE64_VARIANT_URLSAFE

RFC 4648 Base 64 Encoding with URL and Filename Safe Alphabet.

BASE64_VARIANT_URLSAFE_NO_PADDING

RFC 4648 Base 64 Encoding with URL and Filename Safe Alphabet without = padding.

SEE ALSO

FEEDBACK

For reporting bugs, giving feedback, submitting patches, etc. please use the following:

AUTHOR

Brad Barden <perlmodules@5c30.org>

COPYRIGHT & LICENSE

Copyright (c) 2025 Brad Barden. All rights reserved.

This program is free software; you can redistribute it and/or modify it under the same terms as Perl itself.