Commit 8676f5605a for strongswan.org

commit 8676f5605a2975ac54986232e6e757749fb4bd16
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Tue Oct 27 14:20:29 2026 +0100

    openssl: Reject zero length padding in PKCS#7 enveloped-data

    Same as the previous commit.

diff --git a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
index 46584055ec..586f9d7d24 100644
--- a/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
+++ b/src/libstrongswan/plugins/openssl/openssl_pkcs7.c
@@ -599,9 +599,9 @@ static bool remove_padding(chunk_t *data)
 	pos = data->ptr + data->len - 1;
 	padding = pattern = *pos;

-	if (padding > data->len)
+	if (!padding || padding > data->len)
 	{
-		DBG1(DBG_LIB, "padding greater than data length");
+		DBG1(DBG_LIB, "padding invalid");
 		return FALSE;
 	}
 	data->len -= padding;