I ran the fuzzer and found another case. I modified the block size to be 4096 temporarily and managed to get a reproducing test case (committed).
Since we don't run the atomic base64 fuzzer in oss-fuzz (C++20 support being insufficient) I added a CI job, it should be useful at least for now (if that should be merged or not can be debated). It does however use the 128 block size so the reproducer test case it spits out in case of error will not reproduce unless manually changing the block size.

I extended the base64 fuzzer to compare the safe version with the normal version, but I am not sure this is doing the right thing. It hits the abort() with "output differed" pretty easily:

diff --git a/fuzz/base64.cpp b/fuzz/base64.cpp
index 7fe6ded5..964bbea6 100644
--- a/fuzz/base64.cpp
+++ b/fuzz/base64.cpp
@@ -98,6 +98,21 @@ void decode_safe(std::span<const FromChar> base64_, const auto selected_option,
   } break;
   case simdutf::error_code::SUCCESS: {
     // possibility to compare with the normal function
+    std::vector<char> ref_output(output.size() + 10, '\0');
+    const auto ref_result = simdutf::base64_to_binary(
+        base64.data(), std::min(base64.size(), convertresult.count),
+        ref_output.data(), selected_option, last_chunk_option);
+    if (ref_result.error != simdutf::error_code::SUCCESS) {
+      std::cerr << "result code differed, got " << ref_result.error << '\n';
+      std::abort();
+    }
+    // strip away excess
+    ref_output.resize(ref_result.count);
+    output.resize(outlen);
+    if (output != ref_output) {
+      std::cerr << "output differed\n";
+      std::abort();
+    }
   } break;
   default:;
   }

@pauldreik

I extended the base64 fuzzer to compare the safe version with the normal version, but I am not sure this is doing the right thing. It hits the abort() with "output differed" pretty easily:

I am not sure that this code is correct.

But the other issue you have found was indeed a bug and I have fixed it in a later commit. We should now go green.

I have also added additional tests.

all tests but the newly added atomic fuzz job went through. I ran the fuzzer locally (with block size 4096) and got another case, which I pushed as a test case.

I am going to merge this and start a patch release candidate because we have users waiting for this patch.

(If we miss something we can go with an another patch.)