From 53ab8a525b12cfd941333030631387f56b4b00b6 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 2 Mar 2026 15:51:47 +0000 Subject: [PATCH] ccm_finish: Added a boundary check for tag-len. Signed-off-by: Minos Galanakis --- library/ccm.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/library/ccm.c b/library/ccm.c index 969c6c781b..b16b47117e 100644 --- a/library/ccm.c +++ b/library/ccm.c @@ -488,6 +488,11 @@ int mbedtls_ccm_finish(mbedtls_ccm_context *ctx, return MBEDTLS_ERR_CCM_BAD_INPUT; } + if ((tag_len != 0 && (tag_len < 4 || tag_len > 16 || (tag_len & 1) != 0)) || + (tag_len != ctx->tag_len)) { + return MBEDTLS_ERR_CCM_BAD_INPUT; + } + /* * Authentication: reset counter and crypt/mask internal tag */