From 19a590c2b7f3dc479a10aa7d9025538400fba355 Mon Sep 17 00:00:00 2001
From: Francesco Chemolli <5175948+kinkie@users.noreply.github.com>
Date: Thu, 30 Jul 2026 20:01:14 +0000
Subject: [PATCH] Protect base64 username encoding buffer (#2465)

This icap_client_username_header case was missed in recent master/v8
commit 74b12760.
---
 src/adaptation/icap/ModXact.cc | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/adaptation/icap/ModXact.cc b/src/adaptation/icap/ModXact.cc
index 3ad64b8f40..320a6a4f6e 100644
--- a/src/adaptation/icap/ModXact.cc
+++ b/src/adaptation/icap/ModXact.cc
@@ -1566,8 +1566,11 @@ void Adaptation::Icap::ModXact::makeUsernameHeader(const HttpRequest *request, M
 
     if (value) {
         if (TheConfig.client_username_encode) {
+            const auto valueLen = strlen(value);
+            if (valueLen > MAX_LOGIN_SZ)
+                throw TextException("username too long for X-Client-Username header", Here());
             char base64buf[base64_encode_len(MAX_LOGIN_SZ)];
-            size_t resultLen = base64_encode_update(&ctx, base64buf, strlen(value), reinterpret_cast<const uint8_t*>(value));
+            size_t resultLen = base64_encode_update(&ctx, base64buf, valueLen, reinterpret_cast<const uint8_t*>(value));
             resultLen += base64_encode_final(&ctx, base64buf+resultLen);
             buf.appendf("%s: %.*s\r\n", TheConfig.client_username_header, (int)resultLen, base64buf);
         } else
-- 
2.47.3