From 547d11e2a5a85d191e79d6947c6e978112603b66 Mon Sep 17 00:00:00 2001
From: ghozt <ghozt@protonmail.com>
Date: Tue, 17 Mar 2026 14:04:19 +0100
Subject: [PATCH] fix: prevent OOB write in decrypt() for non-multiple-of-16
 src_len

---
 src/Utils.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Utils.cpp b/src/Utils.cpp
index 186c8720a2..113d1673b4 100644
--- a/src/Utils.cpp
+++ b/src/Utils.cpp
@@ -33,7 +33,7 @@ int Utils::decrypt(const uint8_t* shared_secret, uint8_t* dest, const uint8_t* s
   const uint8_t* sp = src;
 
   aes.setKey(shared_secret, CIPHER_KEY_SIZE);
-  while (sp - src < src_len) {
+  while (sp - src + 16 <= src_len) { // ensure full 16-byte block is available before decrypting
     aes.decryptBlock(dp, sp);
     dp += 16; sp += 16;
   }