From 2162fccd7dfddebde01fa9ae5bd3f93f778ef77a Mon Sep 17 00:00:00 2001
From: Ehren Kret <ehren@signal.org>
Date: Mon, 27 Jul 2026 12:06:40 -0500
Subject: [PATCH] Fix base64 decode issue with short signal.me URLs.

---
 .../securesms/profiles/manage/UsernameRepository.kt |  6 +++++-
 .../profiles/manage/UsernameRepositoryTest.kt       | 13 +++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 app/src/test/java/org/thoughtcrime/securesms/profiles/manage/UsernameRepositoryTest.kt

diff --git a/app/src/main/java/org/thoughtcrime/securesms/profiles/manage/UsernameRepository.kt b/app/src/main/java/org/thoughtcrime/securesms/profiles/manage/UsernameRepository.kt
index d10eea236e..fb7c79b885 100644
--- a/app/src/main/java/org/thoughtcrime/securesms/profiles/manage/UsernameRepository.kt
+++ b/app/src/main/java/org/thoughtcrime/securesms/profiles/manage/UsernameRepository.kt
@@ -311,7 +311,11 @@ object UsernameRepository {
   fun parseLink(url: String): UsernameLinkComponents? {
     val match: MatchResult = URL_REGEX.find(url) ?: return null
     val path: String = match.groups[2]?.value ?: return null
-    val allBytes: ByteArray = Base64.decode(path)
+    val allBytes: ByteArray = try {
+      Base64.decode(path)
+    } catch (e: IllegalArgumentException) {
+      return null
+    }
 
     if (allBytes.size != 48) {
       return null
diff --git a/app/src/test/java/org/thoughtcrime/securesms/profiles/manage/UsernameRepositoryTest.kt b/app/src/test/java/org/thoughtcrime/securesms/profiles/manage/UsernameRepositoryTest.kt
new file mode 100644
index 0000000000..5e27c3f1e5
--- /dev/null
+++ b/app/src/test/java/org/thoughtcrime/securesms/profiles/manage/UsernameRepositoryTest.kt
@@ -0,0 +1,13 @@
+package org.thoughtcrime.securesms.profiles.manage
+
+import assertk.assertThat
+import assertk.assertions.isNull
+import org.junit.Test
+
+class UsernameRepositoryTest {
+  @Test
+  fun parseLink_one_character_base64_ref() {
+    val url = "https://signal.me/#eu/A"
+    assertThat(UsernameRepository.parseLink(url)).isNull()
+  }
+}