define safe encoding and decoding lengths more precisely

src/base64.c

@@ -127,7 +127,8 @@ base64_encode(const enum encoding enc, char *restrict const buf,
 	AN(buf);
 	if (in == NULL || inlen == 0)
 		return 0;
-	if (outlen < base64_encode_l(inlen))
+	if ((enc != BASE64URLNOPAD && outlen < base64_encode_l(inlen))
+	    || outlen < base64nopad_encode_l(inlen))
 		return -1;
 
 	while (1) {

src/vmod_convert.h

@@ -40,10 +40,12 @@
  * SAFE LENGTH ESTIMATES
  */
 
-#define base64_decode_l(l)	((l * 3 / 4) + 1)
-#define base64_encode_l(l)	(((((l * 4 / 3) + 3) / 4) * 4) + 1)
-#define hex_encode_l(l)		((l * 2) + 1)
-#define hex_decode_l(l)		((l / 2) + 1)
+#define base64_decode_l(l)	(((l) * 3) >> 2)
+#define base64_l(l)		(((l) << 2) / 3)
+#define base64nopad_encode_l(l)	(base64_l(l) + 1)
+#define base64_encode_l(l)	((((base64_l(l)) + 3) & ~3) + 1)
+#define hex_encode_l(l)		(((l) << 1) + 1)
+#define hex_decode_l(l)		(((l) + 1) >> 1)
 
 /*
  * General interface for an encoder: encode the data at in of length inlen