From e06a278fe4e2b0ea8815358ddfd9ab4f3462b5a8 Mon Sep 17 00:00:00 2001
From: Boris Zbarsky <bzbarsky@apple.com>
Date: Wed, 25 May 2022 11:36:59 -0400
Subject: [PATCH] Make QR code parsing error out if the padding bits are not
 all 0.

Right now we accept invalid QR codes with nonzero padding.
---
 src/setup_payload/QRCodeSetupPayloadParser.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/setup_payload/QRCodeSetupPayloadParser.cpp b/src/setup_payload/QRCodeSetupPayloadParser.cpp
index 150662675f9405..0eb88be7c9d2ab 100644
--- a/src/setup_payload/QRCodeSetupPayloadParser.cpp
+++ b/src/setup_payload/QRCodeSetupPayloadParser.cpp
@@ -365,6 +365,11 @@ CHIP_ERROR QRCodeSetupPayloadParser::populatePayload(SetupPayload & outPayload)
     outPayload.setUpPINCode = static_cast<uint32_t>(dest);
 
     ReturnErrorOnFailure(readBits(buf, indexToReadFrom, dest, kPaddingFieldLengthInBits));
+    if (dest != 0)
+    {
+        ChipLogError(SetupPayload, "Payload padding bits are not all 0: 0x%x", static_cast<unsigned>(dest));
+        return CHIP_ERROR_INVALID_ARGUMENT;
+    }
 
     return populateTLV(outPayload, buf, indexToReadFrom);
 }