I'm talking about exploitation of this vulnerability in general, not the specific case of Flickr. Not everything is a sequence of key-value pairs formatted in UTF-8.

Most of the crypto you're going to run across as a pentester will be in apps written in Java and C#, and in almost every one of those cases, garbage characters won't break a parse. ".split()" works just fine even if you have 16 characters of random high ASCII. It's one of those things C programmers definitely have to unlearn.

Eeeeeeewwwww.

If you're using .split() to "parse" untrusted input, and not even validating it against a regex first, that's an epic fail in its own right.

What a weird thing to say. You trust a regex engine more than you trust "split()"?

I trust a generated parser more than a hand-written one. Any parsing algorithm that involves the use of split() is almost certain to be weakly thought-out and have ill-defined behavior for unexpected input. A well-written parser will never read past the first unexpected character, or at least token.

Attacker controls the length of the message so he can make the padding be only 9 bytes long