ensure correct password

properly check pkcs7 in slowaes

lib/common.py

@@ -248,7 +248,12 @@ def get_seed(self, seedarg):
             try:
                 decrypted_seed = slowaes.decryptData(
                     password_key, encrypted_seed.decode('hex')).encode('hex')
-                decrypted = True
+                #there is a small probability of getting a valid PKCS7 padding
+                #by chance from a wrong password; sanity check the seed length
+                if len(decrypted_seed) == 32:
+                    decrypted = True
+                else:
+                    raise ValueError
             except ValueError:
                 print 'Incorrect password'
                 decrypted = False

lib/slowaes.py

@@ -29,6 +29,8 @@ def strip_PKCS7_padding(s):
     numpads = ord(s[-1])
     if numpads > 16:
         raise ValueError("String ending with %r can't be PCKS7-padded" % s[-1])
+    if not all(numpads == x for x in map(ord, s[-numpads:-1])):
+        raise ValueError("Invalid PKCS7 padding")
     return s[:-numpads]