[metsw24-max]

Heap overflow on short input in Avx2 Base64Encode

Avx2::Base64Encode computes size24 = AlignLoAny(size - 23, 24) with no size >= 23 guard, so any input under 23 bytes wraps the subtraction and the tail loop bound src + size3 - size24 lands 16 or 40 bytes past the input. The encoder then reads past src and writes 24 to 88 bytes past the documented (size + 2) / 3 * 4 output, depending on size and compiler. Valid short input is enough, for example a 16-byte digest, and SimdBase64Encode has no length check of its own.

Fix
Added the guard the Sse41, Neon and Sve2 encoders and Avx2::Base64Decode already use, which should keep the backends consistent.

Notes

• ASan reports a heap-buffer-overflow WRITE at SimdAvx2Base64.cpp:130 for size = 20, and a stack-buffer-overflow WRITE for a 5-byte string with the same buffer setup as the Simd::Base64Encode(std::string) wrapper.
• Base64EncodeAutoTest now covers short sizes and compares a guard region after the output; it fails before the fix and passes after.
• Test -m=a passes with GCC 13 on x86_64 (AVX2, under Rosetta) and aarch64 (NEON). The AVX-512 and SVE builds compile, but I could not run them here. The guard is one compare per call and timing looks unchanged within noise.