From ee9829a32ecc194c9d104a10dc2022919270c5d7 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 3 Mar 2026 11:12:09 +0000 Subject: [PATCH] ccm_finish: Only reject tag_len missmatch when it has been set. Signed-off-by: Minos Galanakis --- library/ccm.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/library/ccm.c b/library/ccm.c index b16b47117e..8025409690 100644 --- a/library/ccm.c +++ b/library/ccm.c @@ -488,8 +488,11 @@ int mbedtls_ccm_finish(mbedtls_ccm_context *ctx, return MBEDTLS_ERR_CCM_BAD_INPUT; } - if ((tag_len != 0 && (tag_len < 4 || tag_len > 16 || (tag_len & 1) != 0)) || - (tag_len != ctx->tag_len)) { + /* Reject invalid tag lengths and mismatches with negotiated length (if set). */ + if (tag_len != 0 && (tag_len < 4 || tag_len > 16 || (tag_len & 1) != 0)) { + return MBEDTLS_ERR_CCM_BAD_INPUT; + } + if ((ctx->state & CCM_STATE__LENGTHS_SET) && tag_len != ctx->tag_len) { return MBEDTLS_ERR_CCM_BAD_INPUT; }