chenhg5/cc-connect · error

invalid message length %d in decrypted data (total %d)

Error message

invalid message length %d in decrypted data (total %d)

What it means

Consistency guard on the embedded message length: the 4-byte big-endian msg_len read from plaintext bytes 16..20 plus the 20-byte header exceeds the total plaintext length, so the declared message would run past the buffer. Like the other post-decrypt guards, this pattern arises when decrypting with the wrong EncodingAESKey — the length field is then random garbage.

Source

Thrown at platform/wecom/wecom.go:777

	if len(cipherData) < aes.BlockSize || len(cipherData)%aes.BlockSize != 0 {
		return "", fmt.Errorf("invalid ciphertext length %d", len(cipherData))
	}

	iv := p.aesKey[:16]
	mode := cipher.NewCBCDecrypter(block, iv)
	plain := make([]byte, len(cipherData))
	mode.CryptBlocks(plain, cipherData)

	plain = pkcs7Unpad(plain)

	if len(plain) < 20 {
		return "", fmt.Errorf("decrypted data too short")
	}

	msgLen := int(binary.BigEndian.Uint32(plain[16:20]))
	if 20+msgLen > len(plain) {
		return "", fmt.Errorf("invalid message length %d in decrypted data (total %d)", msgLen, len(plain))
	}

	msg := string(plain[20 : 20+msgLen])
	corpID := string(plain[20+msgLen:])

	if corpID != p.corpID {
		return "", fmt.Errorf("corp_id mismatch: expected %s, got %s", p.corpID, corpID)
	}

	return msg, nil
}

func pkcs7Unpad(data []byte) []byte {
	if len(data) == 0 {
		return data
	}
	pad := int(data[len(data)-1])
	if pad < 1 || pad > 32 || pad > len(data) {

View on GitHub (pinned to 4000b2338a)

Solutions

1. Verify the EncodingAESKey matches the app that signed the callback — wrong keys produce incoherent length fields
2. Reject the callback rather than retrying
3. Log both numbers (already included) to confirm the garbage-length signature of a key mismatch

When it happens

Trigger: Thrown at platform/wecom/wecom.go:777 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of chenhg5/cc-connect@4000b2338a (2026-09-06). Data as JSON: /api/errors/b9806de10ecb3855. Report an issue: GitHub.