diff --git a/‎crypto/cms/cms_enc.c‎
Lines changed: 6 additions & 4 deletions b/‎crypto/cms/cms_enc.c‎
Lines changed: 6 additions & 4 deletions
@@ -109,13 +109,15 @@ BIO *ossl_cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo *ec,
                 goto err;
             }
             piv = aparams.iv;
-            if (ec->taglen > 0
-                && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
-                       ec->taglen, ec->tag)
-                    <= 0) {
+
+            if (ec->taglen < 4 || ec->taglen > 16
+                || EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, (int)ec->taglen, ec->tag) <= 0) {
                 ERR_raise(ERR_LIB_CMS, CMS_R_CIPHER_AEAD_SET_TAG_ERROR);
                 goto err;
             }
+        } else if (auth) {
+            ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM);
+            goto err;
         }
     }
     len = EVP_CIPHER_CTX_get_key_length(ctx);
Original file line number	Diff line number	Diff line change
`@@ -109,13 +109,15 @@ BIO ossl_cms_EncryptedContent_init_bio(CMS_EncryptedContentInfo ec,`
`109`	`109`	`goto err;`
`110`	`110`	`}`
`111`	`111`	`piv = aparams.iv;`
`112`		`- if (ec->taglen > 0`
`113`		`- && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,`
`114`		`- ec->taglen, ec->tag)`
`115`		`- <= 0) {`
	`112`	`+`
	`113`	`+ if (ec->taglen < 4 \|\| ec->taglen > 16`
	`114`	`+ \|\| EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, (int)ec->taglen, ec->tag) <= 0) {`
`116`	`115`	`ERR_raise(ERR_LIB_CMS, CMS_R_CIPHER_AEAD_SET_TAG_ERROR);`
`117`	`116`	`goto err;`
`118`	`117`	`}`
	`118`	`+ } else if (auth) {`
	`119`	`+ ERR_raise(ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM);`
	`120`	`+ goto err;`
`119`	`121`	`}`
`120`	`122`	`}`
`121`	`123`	`len = EVP_CIPHER_CTX_get_key_length(ctx);`