fish2018/pansou · critical

IV长度不正确: 期望 ，实际

Error message

IV长度不正确: 期望%d，实际%d

What it means

DecryptURL uses the package-level AESIV as the CBC initialization vector and checks that it is exactly aes.BlockSize (16) bytes. CBC mode requires an IV equal to the block size, so any other length aborts with this error reporting the expected and actual sizes. This is a configuration problem with the IV constant, not with the ciphertext.

Solutions

1. Make AESIV exactly 16 bytes (e.g. a 16-character string or 16-byte slice).
2. If the IV is hex/base64-encoded, decode it before use and assert length 16.
3. Add an init-time or unit test assertion len([]byte(AESIV)) == aes.BlockSize so a bad IV is caught at startup instead of at first decrypt.
4. Verify against the SDSO site's actual IV; site format changes may require updating the constant.

Example fix

// before
const AESIV = "shortiv"
// after
const AESIV = "0123456789abcdef" // exactly 16 bytes

iv := []byte(AESIV)
if len(iv) != 16 {
    return fmt.Errorf("AESIV must be 16 bytes, got %d", len(iv))
}

func hasValidIV(iv []byte) bool { return len(iv) == 16 }

When it happens

Trigger: AESIV is defined with a byte length other than 16 — e.g. an 8-byte string, an empty value, or an encoded (hex/base64) IV passed raw. The error fires on every call to DecryptURL when the constant is wrong.

Common situations: Developer shortened or renamed the IV constant; IV loaded from config/env that is missing or wrong length; IV pasted with extra characters like quotes or newline.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• 创建AES加密器失败
• 密文长度不是AES块大小的倍数
• 去除填充失败
• 无效的填充长度
• 无效的填充字节

AI-assisted analysis of fish2018/pansou@beaa561337 (2026-09-07). Data as JSON: /api/errors/4cb7df2f39a0b391. Report an issue: GitHub.

Appendix: source

Thrown at plugin/sdso/sdso.go:408

	if len(ciphertext) == 0 {
		return "", fmt.Errorf("密文长度为0")
	}

	// 检查密文长度是否为16的倍数
	if len(ciphertext)%aes.BlockSize != 0 {
		return "", fmt.Errorf("密文长度不是AES块大小的倍数")
	}

	// 创建AES块加密器
	block, err := aes.NewCipher([]byte(AESKey))
	if err != nil {
		return "", fmt.Errorf("创建AES加密器失败: %w", err)
	}

	// 创建CBC模式解密器
	iv := []byte(AESIV)
	if len(iv) != aes.BlockSize {
		return "", fmt.Errorf("IV长度不正确: 期望%d，实际%d", aes.BlockSize, len(iv))
	}

	mode := cipher.NewCBCDecrypter(block, iv)

	// 解密
	plaintext := make([]byte, len(ciphertext))
	mode.CryptBlocks(plaintext, ciphertext)

	// 去除PKCS7填充
	unpaddedText, err := removePKCS7Padding(plaintext)
	if err != nil {
		return "", fmt.Errorf("去除填充失败: %w", err)
	}

	return string(unpaddedText), nil
}

// removePKCS7Padding 去除PKCS7填充

View on GitHub (pinned to beaa561337)