plugin decoder vulnerability when passed all padding