Fix authTagSz validation

yosuke-wolfssl · yosuke-wolfssl · commit 0a05129bd626 · 2026-04-09T17:15:28.000+09:00
diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c
@@ -12604,7 +12604,7 @@ int wc_AesGcmDecryptFinal(Aes* aes, const byte* authTag, word32 authTagSz)
 
     /* Check validity of parameters. */
     if ((aes == NULL) || (authTag == NULL) || (authTagSz > WC_AES_BLOCK_SIZE) ||
-            (authTagSz == 0)) {
+            (authTagSz < WOLFSSL_MIN_AUTH_TAG_SZ)) {
         ret = BAD_FUNC_ARG;
     }
 

Original file line number	Diff line number	Diff line change
`@@ -12604,7 +12604,7 @@ int wc_AesGcmDecryptFinal(Aes* aes, const byte* authTag, word32 authTagSz)`
`12604`	`12604`
`12605`	`12605`	`/* Check validity of parameters. */`
`12606`	`12606`	`if ((aes == NULL) \|\| (authTag == NULL) \|\| (authTagSz > WC_AES_BLOCK_SIZE) \|\|`
`12607`		`- (authTagSz == 0)) {`
	`12607`	`+ (authTagSz < WOLFSSL_MIN_AUTH_TAG_SZ)) {`
`12608`	`12608`	`ret = BAD_FUNC_ARG;`
`12609`	`12609`	`}`
`12610`	`12610`