pkcs5: Avoid NULL pointer dereference when verifying padding

Can be triggered via empty PKCS#7 encrypted content in IKEv1 CERT payload.

Fixes: 4076e3ee91 ("Extract PKCS#5 handling from pkcs8 plugin to separate helper class")
Fixes: CVE-2026-35329

src/libstrongswan/crypto/pkcs5.c

@@ -113,6 +113,11 @@ static bool verify_padding(crypter_t *crypter, chunk_t *blob)
 {
 	uint8_t padding, count;
 
+	if (!blob->len)
+	{
+		return FALSE;
+	}
+
 	padding = count = blob->ptr[blob->len - 1];
 
 	if (padding > crypter->get_block_size(crypter))