gh-118314: Fix padding edge case in binascii.a2b_base64 strict mode

Lib/test/test_binascii.py

@@ -139,6 +139,9 @@ def assertLeadingPadding(data, non_strict_mode_expected_result: bytes):
         def assertDiscontinuousPadding(data, non_strict_mode_expected_result: bytes):
             _assertRegexTemplate(r'(?i)Discontinuous padding', data, non_strict_mode_expected_result)
 
+        def assertIncorrectPadding(data, non_strict_mode_expected_result: bytes):
+            _assertRegexTemplate(r'(?i)Incorrect padding', data, non_strict_mode_expected_result)
+
         # Test excess data exceptions
         assertExcessData(b'ab==a', b'i')
         assertExcessData(b'ab===', b'i')
@@ -159,6 +162,9 @@ def assertDiscontinuousPadding(data, non_strict_mode_expected_result: bytes):
         assertLeadingPadding(b'===', b'')
         assertDiscontinuousPadding(b'ab=c=', b'i\xb7')
         assertDiscontinuousPadding(b'ab=ab==', b'i\xb6\x9b')
+        assertIncorrectPadding(b'AAAA=', b'\x00\x00\x00')
+        assertIncorrectPadding(b'AAAA==', b'\x00\x00\x00')
+        assertIncorrectPadding(b'AAAA===', b'\x00\x00\x00')
 
 
     def test_base64errors(self):

Misc/NEWS.d/next/Library/2024-04-26-12-42-29.gh-issue-118314.Z7reGc.rst

@@ -0,0 +1 @@
+Fix an edge case in :func:`binascii.a2b_base64` strict mode, where excessive padding is not detected when no padding is necessary.

Modules/binascii.c

@@ -414,6 +414,13 @@ binascii_a2b_base64_impl(PyObject *module, Py_buffer *data, int strict_mode)
         if (this_ch == BASE64_PAD) {
             padding_started = 1;
 
+            if (strict_mode && quad_pos == 0) {
+                state = get_binascii_state(module);
+                if (state) {
+                    PyErr_SetString(state->Error, "Incorrect padding");
+                }
+                goto error_end;
+            }
             if (quad_pos >= 2 && quad_pos + ++pads >= 4) {
                 /* A pad sequence means we should not parse more input.
                 ** We've already interpreted the data from the quad at this point.