Fix McpHeaderEncoder.DecodeValue throwing on the degenerate base64 wrapper (#1805)

src/ModelContextProtocol.Core/Protocol/McpHeaderEncoder.cs

@@ -126,7 +126,8 @@ public static class McpHeaderEncoder
 
         // Check for Base64 wrapper. The spec requires the sentinel markers to be
         // case-sensitive and exactly lowercase per SEP-2243.
-        if (headerValue.StartsWith(Base64Prefix, StringComparison.Ordinal) &&
+        if (headerValue.Length >= Base64Prefix.Length + Base64Suffix.Length &&
+            headerValue.StartsWith(Base64Prefix, StringComparison.Ordinal) &&
             headerValue.EndsWith(Base64Suffix, StringComparison.Ordinal))
         {
             var base64Content = headerValue.Substring(

tests/ModelContextProtocol.Tests/Client/McpHeaderEncoderTests.cs

@@ -104,6 +104,16 @@ public class McpHeaderEncoderTests
         Assert.Equal("Hello", result);
     }
 
+    [Fact]
+    public void DecodeValue_DegenerateWrapper_ReturnsLiteralValue()
+    {
+        // "=?base64?=" matches both the prefix "=?base64?" and the suffix "?=" because they
+        // overlap on the shared '?', but it is too short to contain any base64 content. It must be
+        // returned as-is rather than throwing when the wrapper is stripped.
+        var result = McpHeaderEncoder.DecodeValue("=?base64?=");
+        Assert.Equal("=?base64?=", result);
+    }
+
     [Fact]
     public void DecodeValue_CaseSensitivePrefix_ReturnsLiteralValue()
     {