Looks to me as though the existing code in StringBuffer &JBASE64_Decode(const char *incs, StringBuffer &out)
has the same bug regarding potentially reading off the end of the buffer