Decrypting with CBC+PKCS7 requires an extra block on the output buffer

[zugzwang]

Let c be a N+1-block ciphertext encrypting a plaintext of N blocks (i.e. with one full-block padding).
When calling decrypt on c, the output buffer needs N+2 blocks for decryption to be carried correctly (if it has less than (N+2) * blocksize bytes, it errors with CipherFullBlockExpected).

This is because here

rust-mbedtls/mbedtls/src/cipher/raw/mod.rs

Line 231 in 7750efa

indata.len() + self.block_size()

indata is already N+1 blocks - the space necessary to process the ciphertext. The additional block length needs to be added only when encrypting.

[zugzwang]

Though the extra block could be dropped on decryption (and in fact, works for most modes relaxing the requirement above), this is compliant with mbed TLS API documentation - the output buffer needs to hold at least one additional block, therefore, N+2 blocks while decrypting (thanks @jethrogb).