From 7bf0215f8d2a5b4ca5b56c4692ef09176a342e91 Mon Sep 17 00:00:00 2001 From: Ben Taylor Date: Thu, 28 May 2026 08:53:13 +0100 Subject: [PATCH] Add guard to prevent wraparound if SIZE_MAX > UINT64_MAX in chacha20 Signed-off-by: Ben Taylor --- library/chacha20.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/library/chacha20.c b/library/chacha20.c index 484bf7cfdf..84289163fc 100644 --- a/library/chacha20.c +++ b/library/chacha20.c @@ -212,6 +212,12 @@ static int chacha20_check_counter_wrap(const mbedtls_chacha20_context *ctx, return size == 0U ? 0 : MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA; } +#if SIZE_MAX >= UINT64_MAX + if (size > UINT64_MAX / 2) { + return MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA; + } +#endif + if (ctx->keystream_bytes_used < CHACHA20_BLOCK_SIZE_BYTES) { available_keystream = CHACHA20_BLOCK_SIZE_BYTES - ctx->keystream_bytes_used;