@@ -373,9 +373,7 @@ static WC_INLINE int wc_XChaCha20Poly1305_crypt_oneshot(
373373 int isEncrypt )
374374{
375375 int ret ;
376- long int dst_len = isEncrypt ?
377- (long int )src_len + POLY1305_DIGEST_SIZE :
378- (long int )src_len - POLY1305_DIGEST_SIZE ;
376+ size_t dst_len ;
379377 const byte * src_i ;
380378 byte * dst_i ;
381379 size_t src_len_rem ;
@@ -388,12 +386,27 @@ static WC_INLINE int wc_XChaCha20Poly1305_crypt_oneshot(
388386 ChaChaPoly_Aead aead_buf , * aead = & aead_buf ;
389387#endif
390388
389+ if (isEncrypt ) {
390+ if (src_len > (size_t )(CHACHA20_POLY1305_MAX - POLY1305_DIGEST_SIZE )) {
391+ ret = BAD_FUNC_ARG ;
392+ goto out ;
393+ }
394+ dst_len = src_len + (size_t )POLY1305_DIGEST_SIZE ;
395+ }
396+ else {
397+ if (src_len < POLY1305_DIGEST_SIZE ) {
398+ ret = BAD_FUNC_ARG ;
399+ goto out ;
400+ }
401+ dst_len = src_len - (size_t )POLY1305_DIGEST_SIZE ;
402+ }
403+
391404 if ((dst == NULL ) || (src == NULL )) {
392405 ret = BAD_FUNC_ARG ;
393406 goto out ;
394407 }
395408
396- if (dst_len < 0 || ( long int ) dst_space < dst_len ) {
409+ if (dst_space < dst_len ) {
397410 ret = BUFFER_E ;
398411 goto out ;
399412 }
@@ -412,7 +425,7 @@ static WC_INLINE int wc_XChaCha20Poly1305_crypt_oneshot(
412425 * and to exploit hot cache for the input data.
413426 */
414427 src_i = src ;
415- src_len_rem = isEncrypt ? src_len : ( size_t ) dst_len ;
428+ src_len_rem = isEncrypt ? src_len : dst_len ;
416429 dst_i = dst ;
417430 while (src_len_rem > 0 ) {
418431 word32 this_src_len =
@@ -437,9 +450,9 @@ static WC_INLINE int wc_XChaCha20Poly1305_crypt_oneshot(
437450 }
438451
439452#ifdef WORD64_AVAILABLE
440- ret = wc_Poly1305_EncodeSizes64 (& aead -> poly , ad_len , isEncrypt ? src_len : ( size_t ) dst_len );
453+ ret = wc_Poly1305_EncodeSizes64 (& aead -> poly , ad_len , isEncrypt ? src_len : dst_len );
441454#else
442- ret = wc_Poly1305_EncodeSizes (& aead -> poly , ad_len , isEncrypt ? src_len : ( size_t ) dst_len );
455+ ret = wc_Poly1305_EncodeSizes (& aead -> poly , ad_len , isEncrypt ? src_len : dst_len );
443456#endif
444457 if (ret < 0 )
445458 goto out ;
0 commit comments