This is incorrect. The padding should never be null characters. The padding should always be PKCS#7. If there is one byte of padding, then there is one 0x01. If there are two bytes of padding, then there are two 0x02's. Etc. If there is no padding required, then there is a full block (16-bytes) of 0x10 appended. The decryption code needs to verify the padding. (I know this was wrong in Guysung's code as well.)