From f3fb63aea7259391228465cd0c6fb9d5faaefff8 Mon Sep 17 00:00:00 2001
From: Paul Adelsbach <paul.adelsbach@wolfssl.com>
Date: Wed, 14 Jan 2026 09:31:35 -0800
Subject: [PATCH] Add length check to Hmac_UpdateFinal_CT to prevent build
 error

---
 src/tls.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/tls.c b/src/tls.c
index 9f0e2796a1a..b8ee47711ff 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -937,6 +937,9 @@ static int Hmac_UpdateFinal_CT(Hmac* hmac, byte* digest, const byte* in,
     word32       realLen;
     byte         extraBlock;
 
+    if (macLen <= 0 || macLen > (int)sizeof(hmac->innerHash))
+        return BAD_FUNC_ARG;
+
     switch (hmac->macType) {
     #ifndef NO_SHA
         case WC_SHA: