Suricata

Summary
As per RFC 2045 (MIME),
"SP"s are allowed in base64 encoded transfers and should be discarded.

Explanation
Quote (https://www.ietf.org/rfc/rfc2045.txt):

   All line breaks or other characters not
   found in Table 1 must be ignored by decoding software.  In base64
   data, characters other than those in Table 1, line breaks, and other
   white space probably indicate a transmission error, about which a
   warning message or even a message rejection might be appropriate
   under some circumstances.

                    Table 1: The Base64 Alphabet

     Value Encoding  Value Encoding  Value Encoding  Value Encoding
         0 A            17 R            34 i            51 z
         1 B            18 S            35 j            52 0
         2 C            19 T            36 k            53 1
         3 D            20 U            37 l            54 2
         4 E            21 V            38 m            55 3
         5 F            22 W            39 n            56 4
         6 G            23 X            40 o            57 5
         7 H            24 Y            41 p            58 6
         8 I            25 Z            42 q            59 7
         9 J            26 a            43 r            60 8
        10 K            27 b            44 s            61 9
        11 L            28 c            45 t            62 +
        12 M            29 d            46 u            63 /
        13 N            30 e            47 v
        14 O            31 f            48 w         (pad) =
        15 P            32 g            49 x
        16 Q            33 h            50 y

Issue
As a result of not discarding the spaces, the decoding would fail whenever the parser would encounter base64 encoded data with spaces.

Issue Discovery
This was found during SMTP file extraction when the extracted files were broken and the new approach of PreProcessing data commands to avoid buffering generated different decoded data.
This seems to have been broken since the parser was written.

Issue found by
Victor Julien <vjulien@oisf.net>