evp: prevent underflow in base64 decoding