Commit b063559198 for strongswan.org

commit b063559198edc8c86c278dc93417e1d4adac366c
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Tue Oct 27 14:00:14 2026 +0100

    pkcs7: Reject zero length padding

    Similar to the previous commit.  However, because enveloped-data is
    usually wrapped in signed-data, this is unlikely to get triggered unless
    the sender was buggy.

diff --git a/src/libstrongswan/plugins/pkcs7/pkcs7_enveloped_data.c b/src/libstrongswan/plugins/pkcs7/pkcs7_enveloped_data.c
index 795d979fd4..d88e498484 100644
--- a/src/libstrongswan/plugins/pkcs7/pkcs7_enveloped_data.c
+++ b/src/libstrongswan/plugins/pkcs7/pkcs7_enveloped_data.c
@@ -194,9 +194,9 @@ static bool remove_padding(private_pkcs7_enveloped_data_t *this)
 	pattern = *pos;
 	padding = pattern;

-	if (padding > this->content.len)
+	if (!padding || padding > this->content.len)
 	{
-		DBG1(DBG_LIB, "padding greater than data length");
+		DBG1(DBG_LIB, "padding invalid");
 		return FALSE;
 	}
 	this->content.len -= padding;