proofs.rs

Empty input panics in three raw unpadding implementations

Empty input panics in three raw unpadding implementations

Found in Report #15 v1 · Updated 2026-11-03 11:41 UTC

Description

In block-padding 0.4.2, Pkcs7::raw_unpad, Iso10126::raw_unpad, and AnsiX923::raw_unpad panic on an empty slice. Padding::raw_unpad says malformed padding returns an error, and an empty slice has no final count byte.

Steps to Reproduce
use block_padding::{Padding, Pkcs7};

assert!(Pkcs7::raw_unpad(&[]).is_err());
Expected Behavior

The call returns Err for the malformed block.

Actual Behavior

The call panics instead of returning a result.

Environment

block-padding 0.4.2; reproduced in debug and release builds.

Change history
  1. v1 · created · 2026-11-03 11:41 UTC
    {
      "title": "Empty input panics in three raw unpadding implementations",
      "body": "## Description\n\nIn block-padding 0.4.2, `Pkcs7::raw_unpad`, `Iso10126::raw_unpad`, and `AnsiX923::raw_unpad` panic on an empty slice. `Padding::raw_unpad` says malformed padding returns an error, and an empty slice has no final count byte.\n\n## Steps to Reproduce\n\n```rust\nuse block_padding::{Padding, Pkcs7};\n\nassert!(Pkcs7::raw_unpad(&[]).is_err());\n```\n\n## Expected Behavior\n\nThe call returns `Err` for the malformed block.\n\n## Actual Behavior\n\nThe call panics instead of returning a result.\n\n## Environment\n\nblock-padding 0.4.2; reproduced in debug and release builds.",
      "validity": "reported",
      "upstream_status": "not_reported"
    }

Read and join the discussion on the report →