ccm_finish: Added a boundary check for tag-len.

Signed-off-by: Minos Galanakis <[email protected]>
2026-08-21 02:39:53 +00:00 · 2026-03-03 11:24:35 +00:00
parent d6f635e3f3
commit 53ab8a525b
1 changed files with 5 additions and 0 deletions
@@ -488,6 +488,11 @@ int mbedtls_ccm_finish(mbedtls_ccm_context *ctx,
        return MBEDTLS_ERR_CCM_BAD_INPUT;
    }

+    if ((tag_len != 0 && (tag_len < 4 || tag_len > 16 || (tag_len & 1) != 0)) ||
+        (tag_len != ctx->tag_len)) {
+        return MBEDTLS_ERR_CCM_BAD_INPUT;
+    }
+
    /*
     * Authentication: reset counter and crypt/mask internal tag
     */