From 13c92b0a2ed3a76ea98dcd6f378e09874bcfd7c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E1=B4=8D=E1=B4=8F=E1=B4=8F=C9=B4D4=CA=80=E1=B4=8B?=
 <moond4rk13@gmail.com>
Date: Mon, 18 Apr 2022 00:38:40 +0800
Subject: [PATCH] fix: add block size check, Close #120

---
 internal/decrypter/decrypter.go | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/internal/decrypter/decrypter.go b/internal/decrypter/decrypter.go
index d93d58f..88b4081 100644
--- a/internal/decrypter/decrypter.go
+++ b/internal/decrypter/decrypter.go
@@ -179,14 +179,17 @@ func aes128CBCDecrypt(key, iv, encryptPass []byte) ([]byte, error) {
 	dst := make([]byte, encryptLen)
 	mode := cipher.NewCBCDecrypter(block, iv)
 	mode.CryptBlocks(dst, encryptPass)
-	dst = PKCS5UnPadding(dst)
+	dst = pkcs5UnPadding(dst, block.BlockSize())
 	return dst, nil
 }
 
-func PKCS5UnPadding(src []byte) []byte {
-	length := len(src)
-	unpad := int(src[length-1])
-	return src[:(length - unpad)]
+func pkcs5UnPadding(src []byte, blockSize int) []byte {
+	n := len(src)
+	paddingNum := int(src[n-1])
+	if n < paddingNum || paddingNum > blockSize {
+		return src
+	}
+	return src[:n-paddingNum]
 }
 
 // des3Decrypt use for decrypter firefox PBE
@@ -198,7 +201,7 @@ func des3Decrypt(key, iv []byte, src []byte) ([]byte, error) {
 	blockMode := cipher.NewCBCDecrypter(block, iv)
 	sq := make([]byte, len(src))
 	blockMode.CryptBlocks(sq, src)
-	return sq, nil
+	return pkcs5UnPadding(sq, block.BlockSize()), nil
 }
 
 func paddingZero(s []byte, l int) []byte {