Check the first $padding_length of padding bytes
Check the first $padding_length of padding bytes

Manuel Barbosa from HASLab - INESC TEC, DCC FC Universidade do Porto,
http://haslab.pt/mbb, analysed our CBC verification algorithm and found that
rather than checking the first $padding_length bytes of the padding, we were
checking one-byte over (i.e. including the padding length byte itself).

Before this commit:

  Byte:    0 1 2 3 4 5
  Value:   5 5 5 5 5 5
  Checked:   X X X X X

After this commit:

  Byte:    0 1 2 3 4 5
  Value:   5 5 5 5 5 5
  Checked: X X X X X

With this commit, s2n correctly checks all of the padding bytes for
equality with the padding length value. We no longer check that the
padding length byte is equal to itself.

alexeblee/s2n,jqk6/s2n,PKRoma/s2n,bpdavidson/s2n,PKRoma/s2n,gibson-compsci/s2n,wcs1only/s2n,colmmacc/s2n,raycoll/s2n,awslabs/s2n,alexeblee/s2n,PKRoma/s2n,awslabs/s2n,awslabs/s2n,wcs1only/s2n,awslabs/s2n,alexeblee/s2n,colmmacc/s2n,wcs1only/s2n,colmmacc/s2n,wcs1only/s2n,bpdavidson/s2n,bpdavidson/s2n,bpdavidson/s2n,jldodds/s2n,raycoll/s2n,awslabs/s2n,alexeblee/s2n,colmmacc/s2n,gibson-compsci/s2n,raycoll/s2n,alexeblee/s2n,raycoll/s2n,jfigus/s2n,raycoll/s2n,colmmacc/s2n,colmmacc/s2n,gibson-compsci/s2n,wcs1only/s2n,awslabs/s2n,jldodds/s2n,raycoll/s2n,wcs1only/s2n,PKRoma/s2n,gibson-compsci/s2n,PKRoma/s2n,PKRoma/s2n,jldodds/s2n,wcs1only/s2n,bpdavidson/s2n,alexeblee/s2n,bpdavidson/s2n,PKRoma/s2n,jldodds/s2n,wcs1only/s2n,gibson-compsci/s2n,gibson-compsci/s2n,jldodds/s2n,PKRoma/s2n