header len bug in CBC decryption