{"record":{"id":"20fb817da44e03e4","repo":"phalcon/cphalcon","slug":"padding-size-cannot-be-less-than-0-or-greater-than","errorCode":null,"errorMessage":"Padding size cannot be less than 0 or greater than 256","messagePattern":"Padding size cannot be less than 0 or greater than 256","errorType":"exception","errorClass":"InvalidPaddingSize","httpStatus":null,"severity":"error","filePath":"phalcon/Encryption/Crypt.zep","lineNumber":694,"sourceCode":"     * @return string\n     * @throws Exception\n     */\n    protected function cryptPadText(\n        string input,\n        string mode,\n        int blockSize,\n        int paddingType\n    ) -> string {\n        var padding, paddingSize, service;\n\n        let padding     = \"\",\n            paddingSize = 0;\n\n        if true === this->checkIsMode([\"cbc\"], mode) {\n            let paddingSize = blockSize - (strlen(input) % blockSize);\n\n            if paddingSize >= 256 || paddingSize < 0 {\n                throw new InvalidPaddingSize();\n            }\n\n            let service = this->padFactory->padNumberToService(paddingType),\n                padding = this->padFactory->newInstance(service)\n                                          ->pad(paddingSize);\n        }\n\n        if 0 === paddingSize {\n            return input;\n        }\n\n        return input . substr(padding, 0, paddingSize);\n    }\n\n    /**\n     * Removes a padding from a text.\n     *\n     * If the function detects that the text was not padded, it will return it","sourceCodeStart":676,"sourceCodeEnd":712,"githubUrl":"https://github.com/phalcon/cphalcon/blob/b7419de9cd0a8a3f48441ead84c9f8415d463e25/phalcon/Encryption/Crypt.zep#L676-L712","documentation":"In CBC mode Crypt::encryptGetPadded() computes paddingSize = blockSize - (strlen(input) % blockSize) and requires it to stay within 0..255; otherwise it throws InvalidPaddingSize. With mainstream ciphers (AES blockSize 16) paddingSize is always 1..16, so in practice this error indicates an exotic cipher whose block size is 256+ or a degenerate blockSize of 0 from an unexpected cipher configuration.","triggerScenarios":"Calling encrypt() with 'cbc' mode on a cipher whose block size pushes the computed pad beyond 255 (e.g., certain non-standard/legacy algorithms), or an OpenSSL build reporting an anomalous block size for the configured cipher. Not reachable with aes-*-cbc under normal conditions.","commonSituations":"Nearly always an indirect symptom of an unusual setCipher() choice on an odd OpenSSL build; effectively a defensive guard rather than an error users are expected to hit with AES.","solutions":["Switch to a standard cipher such as aes-256-cbc or aes-128-cbc where blockSize is 16 and the pad is always 1..16.","Verify what OpenSSL reports for the cipher: php -r '$m = openssl_get_cipher_methods(true); ...' and check the cipher is mainstream.","If you truly need the exotic cipher, pre-pad the input yourself so the computed paddingSize falls in range is NOT supported by this API - use a lower-level openssl_encrypt call instead."],"exampleFix":"// before\n$crypt->setCipher('des3-cbc-weird-variant');\n$crypt->encrypt($data); // block size anomaly -> InvalidPaddingSize\n\n// after\n$crypt->setCipher('aes-256-cbc');\n$crypt->encrypt($data);","handlingStrategy":"validation","validationCode":"// With cbc mode, ensure the computed pad would be in range before encrypting:\n$blockSize = 16; // AES\n$paddingSize = $blockSize - (strlen($data) % $blockSize);\nif ($paddingSize >= 256 || $paddingSize < 0) {\n    throw new \\RuntimeException('Cipher/padding combination unsupported');\n}\n$crypt->encrypt($data);","typeGuard":null,"tryCatchPattern":"try {\n    $cipherText = $crypt->encrypt($data);\n} catch (\\Phalcon\\Encryption\\Crypt\\Exception\\InvalidPaddingSize $e) {\n    // exotic cipher/block-size combination - switch to a standard cipher\n    $logger->error('Padding out of range - unsupported cipher configuration');\n    throw $e;\n}","preventionTips":["Standardize on AES ciphers where blockSize is 16 and this state is unreachable.","Treat this exception as a signal that setCipher() got an exotic value - audit cipher configuration."],"tags":["phalcon","crypt","padding","cbc","block-size"],"backgroundTag":"invalid-padding-size","analyzedSha":"b7419de9cd0a8a3f48441ead84c9f8415d463e25","analyzedAt":"2026-08-21T06:21:18.811Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}