From 4c4f2f55c32efd494a7503234f785745ef8a5151 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A1draig=20Brady?= <P@draigBrady.com>
Date: Thu, 22 Oct 2026 13:25:39 +0100
Subject: [PATCH] basenc: fix incorrect base32hex input validation

* src/basenc.c (base32hex_decode_ctx_wrapper): Ensure we don't
accept base32 only characters for base32hex.
* tests/basenc/basenc.pl: Ensure negative base32hex tests have the
appropriate number of characters to test character validation
rather than just input size validation.
* NEWS: Mention the bug fix.

Discovered by Anthropic's OSS Scanner, as bug ANT-2026-EP1XO2G4.
---
 NEWS                   | 3 +++
 src/basenc.c           | 2 ++
 tests/basenc/basenc.pl | 4 ++--
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/NEWS b/NEWS
index 8c4babc18..b315ce7f4 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,9 @@ GNU coreutils NEWS                                    -*- outline -*-
 
 ** Bug fixes
 
+  'basenc --base32hex' no longer decodes BASE32 only characters "WXYZ".
+  [bug introduced with the basenc program in coreutils-8.31]
+
   'chroot --userspec=USER' now uses the primary group of USER as looked up
   inside the chroot.  Previously the group looked up outside the chroot
   was used, even when the look-up inside the chroot succeeded.
diff --git a/src/basenc.c b/src/basenc.c
index 8aaef0d8b..3ab53b4ca 100644
--- a/src/basenc.c
+++ b/src/basenc.c
@@ -645,6 +645,8 @@ base32hex_decode_ctx_wrapper (struct base_decode_context *ctx,
     {
       if (isubase32hex (*in))
         *p = base32_hex_to_norm[*in - 0x30];
+      else if (isubase32 (*in))
+        *p = '0'; /* Ensure base32 rejects non hex variant.  */
       else
         *p = *in;
       ++p;
diff --git a/tests/basenc/basenc.pl b/tests/basenc/basenc.pl
index 3749e8720..e1acc38f9 100755
--- a/tests/basenc/basenc.pl
+++ b/tests/basenc/basenc.pl
@@ -166,9 +166,9 @@ my @Tests =
  ['b32h_2', '--base32hex -d',    {IN=>$base32hex_out}, {OUT=>$base32_in}],
  ['b32h_3', '--base32hex -d -i', {IN=>'/'.$base32hex_out}, {OUT=>$base32_in}],
  ['b32h_4', '--base32hex -d -i', {IN=>'W'.$base32hex_out}, {OUT=>$base32_in}],
- ['b32h_5', '--base32hex -d',    {IN=>$base32hex_out.'W'}, , {OUT=>$base32_in},
+ ['b32h_5', '--base32hex -d',    {IN=>$base32hex_out.'WXYZW'},{OUT=>$base32_in},
   {EXIT=>1},  {ERR=>"$prog: invalid input\n"}],
- ['b32h_6', '--base32hex -d',    {IN=>$base32hex_out.'/'}, {OUT=>$base32_in},
+ ['b32h_6', '--base32hex -d',    {IN=>$base32hex_out.'/////'},{OUT=>$base32_in},
   {EXIT=>1},  {ERR=>"$prog: invalid input\n"}],
  ['b32h_7',  '--base32hex',      {IN=>$base32_in2},     {OUT=>$base32hex_out2}],
  ['b32h_8',  '--base32hex -d',   {IN=>$base32hex_out2},     {OUT=>$base32_in2}],