Merge pull request JoinMarket-Org#191 from AdamISZ/pkcs7sanitycheck

ensure correct password

lib/common.py

@@ -248,7 +248,12 @@ def get_seed(self, seedarg):
  try:
  decrypted_seed = slowaes.decryptData(
  password_key, encrypted_seed.decode('hex')).encode('hex')
- decrypted = True
+ #there is a small probability of getting a valid PKCS7 padding
+ #by chance from a wrong password; sanity check the seed length
+ if len(decrypted_seed) == 32:
+ decrypted = True
+ else:
+ raise ValueError
  except ValueError:
  print 'Incorrect password'
  decrypted = False

lib/slowaes.py

@@ -29,6 +29,8 @@ def strip_PKCS7_padding(s):
  numpads = ord(s[-1])
  if numpads > 16:
  raise ValueError("String ending with %r can't be PCKS7-padded" % s[-1])
+ if not all(numpads == x for x in map(ord, s[-numpads:-1])):
+ raise ValueError("Invalid PKCS7 padding")
  return s[:-numpads]