From d77f5154a55129d2231b5c64bbf2436176ddec45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mike=20F=C3=A4hrmann?= <mike_faehrmann@web.de>
Date: Sun, 3 Nov 2024 21:25:45 +0100
Subject: [PATCH] [aes] fix GCM pad length calculation

https://github.com/yt-dlp/yt-dlp/pull/11438
---
 gallery_dl/aes.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/gallery_dl/aes.py b/gallery_dl/aes.py
index 22cb0528..891104ab 100644
--- a/gallery_dl/aes.py
+++ b/gallery_dl/aes.py
@@ -227,11 +227,12 @@ def aes_gcm_decrypt_and_verify(data, key, tag, nonce):
     decrypted_data = aes_ctr_decrypt(
         data, key, iv_ctr + [0] * (BLOCK_SIZE_BYTES - len(iv_ctr)))
 
-    pad_len = len(data) // 16 * 16
+    pad_len = (
+        (BLOCK_SIZE_BYTES - (len(data) % BLOCK_SIZE_BYTES)) % BLOCK_SIZE_BYTES)
     s_tag = ghash(
         hash_subkey,
         data +
-        [0] * (BLOCK_SIZE_BYTES - len(data) + pad_len) +  # pad
+        [0] * pad_len +                           # pad
         bytes_to_intlist(
             (0 * 8).to_bytes(8, "big") +          # length of associated data
             ((len(data) * 8).to_bytes(8, "big"))  # length of data