Potential integer overflow in Base64 decode size calculation (DecodeBase64ToBuf)

Description

In DecodeBase64ToBuf(), the buffer size for Base64 decoding is calculated as:

uint32 cubDecodeSize = cbEncoded * 3 / 4 + 1;

This calculation could potentially overflow if cbEncoded ever exceeds 0x55555555. While this is currently mitigated by input size limits (e.g., certificate size is capped at 4096 bytes), adding a defensive check would improve code robustness.

Proof of Concept

uint32 cbEncoded = 0xAAAAAAAA;
uint32 cubDecodeSize = cbEncoded * 3 / 4 + 1;
// Result: 0x40000000 (1 GB)

Suggested Improvement

To prevent potential issues if input size limits change in the future:

if ( cbEncoded > 0x55555555 ) {
    return false;
}
uint32 cubDecodeSize = cbEncoded * 3 / 4 + 1;

Severity

Low — Not currently exploitable due to existing input size restrictions.
Suggested as a defense-in-depth hardening measure.

Start at DecodeBase64ToBuf() and inspect how cbEncoded is obtained and how existing input limits constrain it. Add the defensive oversized-input handling described in the issue, then verify that oversized values are rejected without arithmetic overflow and that normal Base64 decoding remains unchanged.