From 362eda5b257ac05edbd8d0b344742f3292273f1a Mon Sep 17 00:00:00 2001
From: Jeremiah Mackey <jeremiahmackey91@gmail.com>
Date: Mon, 6 Apr 2026 22:15:07 +0000
Subject: [PATCH] add NULL checks to Base64 encode/decode

---
 wolfcrypt/src/coding.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/wolfcrypt/src/coding.c b/wolfcrypt/src/coding.c
index 6347361ce4..e2ac7d3377 100644
--- a/wolfcrypt/src/coding.c
+++ b/wolfcrypt/src/coding.c
@@ -174,6 +174,9 @@ int Base64_Decode_nonCT(const byte* in, word32 inLen, byte* out, word32* outLen)
     int ret;
     const byte maxIdx = BASE64DECODE_TABLE_SZ + BASE64_MIN - 1;
 
+    if ((in == NULL && inLen > 0) || out == NULL || outLen == NULL)
+        return BAD_FUNC_ARG;
+
     while (inLen > 3) {
         int pad3 = 0;
         int pad4 = 0;
@@ -273,6 +276,9 @@ int Base64_Decode(const byte* in, word32 inLen, byte* out, word32* outLen)
     word32 j = 0;
     int ret;
 
+    if ((in == NULL && inLen > 0) || out == NULL || outLen == NULL)
+        return BAD_FUNC_ARG;
+
     while (inLen > 3) {
         int pad3 = 0;
         int pad4 = 0;
@@ -474,6 +480,9 @@ static int DoBase64_Encode(const byte* in, word32 inLen, byte* out,
     word32 outSz = (inLen + 3 - 1) / 3 * 4;
     word32 addSz = (outSz + BASE64_LINE_SZ - 1) / BASE64_LINE_SZ;  /* new lines */
 
+    if (in == NULL && inLen > 0)
+        return BAD_FUNC_ARG;
+
     if (escaped == WC_ESC_NL_ENC)
         addSz *= 3;   /* instead of just \n, we're doing %0A triplet */
     else if (escaped == WC_NO_NL_ENC)