Add fuzzer for mode unpadding, and fix bugs found thereby

Both PKCS7 and X9.23 padding modes did not examine the first byte
of the purported padding if the padding took an entire block. So
for example for a 64-bit cipher, PKCS7 would accept XX08080808080808
as a valid padding for any byte value.

1 files changed, 8 insertions, 0 deletions

diff --git a/src/lib/utils/ct_utils.h b/src/lib/utils/ct_utils.h
index 4fd06ec3d..f4f881871 100644
--- a/src/lib/utils/ct_utils.h
+++ b/src/lib/utils/ct_utils.h
@@ -149,6 +149,14 @@ inline T is_lte(T a, T b)
    return CT::is_less(a, b) | CT::is_equal(a, b);
    }
 
+template<typename C, typename T>
+inline T conditional_return(C condvar, T left, T right)
+   {
+   const T val = CT::select(CT::expand_mask<T>(condvar), left, right);
+   CT::unpoison(val);
+   return val;
+   }
+
 template<typename T>
 inline T conditional_copy_mem(T value,
                               T* to,