Fixing a bug on platforms where size_t is unsigned.

src/charon/encoding/payloads/encryption_payload.c

@@ -480,15 +480,15 @@ static status_t decrypt(private_encryption_payload_t *this)
 	/* add one byte to the padding length, since the padding_length field is
 	 * not included */
 	padding_length++;
-	this->decrypted.len -= padding_length;
 
 	/* check size again */
-	if (padding_length > concatenated.len || this->decrypted.len < 0)
+	if (padding_length > concatenated.len || padding_length > this->decrypted.len)
 	{
 		DBG1(DBG_ENC, "decryption failed, invalid padding length found. Invalid key?");
 		/* decryption failed :-/ */
 		return FAILED;
 	}
+	this->decrypted.len -= padding_length;
 
 	/* free padding */
 	this->decrypted.ptr = realloc(this->decrypted.ptr, this->decrypted.len);