blake2*_final() should return an error if called twice

4 files changed, 33 insertions, 0 deletions

diff --git a/ref/blake2b-ref.c b/ref/blake2b-ref.c
index dd728bc..0e36ee2 100644
--- a/ref/blake2b-ref.c
+++ b/ref/blake2b-ref.c
@@ -58,6 +58,11 @@ static inline int blake2b_clear_lastnode( blake2b_state *S )
 }
 
 /* Some helper functions, not necessarily useful */
+static inline int blake2b_is_lastblock( const blake2b_state *S )
+{
+  return S->f[0] != 0;
+}
+
 static inline int blake2b_set_lastblock( blake2b_state *S )
 {
   if( S->last_node ) blake2b_set_lastnode( S );
@@ -317,6 +322,9 @@ int blake2b_final( blake2b_state *S, uint8_t *out, uint8_t outlen )
   if( out == NULL || outlen == 0 || outlen > BLAKE2B_OUTBYTES )
     return -1;
 
+  if( blake2b_is_lastblock( S ) )
+    return -1;
+
   if( S->buflen > BLAKE2B_BLOCKBYTES )
   {
     blake2b_increment_counter( S, BLAKE2B_BLOCKBYTES );
diff --git a/ref/blake2s-ref.c b/ref/blake2s-ref.c
index 2bab23f..a10f7ef 100644
--- a/ref/blake2s-ref.c
+++ b/ref/blake2s-ref.c
@@ -53,6 +53,11 @@ static inline int blake2s_clear_lastnode( blake2s_state *S )
 }
 
 /* Some helper functions, not necessarily useful */
+static inline int blake2s_is_lastblock( const blake2s_state *S )
+{
+  return S->f[0] != 0;
+}
+
 static inline int blake2s_set_lastblock( blake2s_state *S )
 {
   if( S->last_node ) blake2s_set_lastnode( S );
@@ -306,6 +311,10 @@ int blake2s_final( blake2s_state *S, uint8_t *out, uint8_t outlen )
   if( out == NULL || outlen == 0 || outlen > BLAKE2S_OUTBYTES )
     return -1;
 
+  if( blake2s_is_lastblock( S ) )
+    return -1;
+
+
   if( S->buflen > BLAKE2S_BLOCKBYTES )
   {
     blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );
diff --git a/sse/blake2b.c b/sse/blake2b.c
index 2d4a17b..1eba735 100644
--- a/sse/blake2b.c
+++ b/sse/blake2b.c
@@ -79,6 +79,11 @@ static inline int blake2b_clear_lastnode( blake2b_state *S )
   return 0;
 }
 
+static inline int blake2b_is_lastblock( const blake2b_state *S )
+{
+  return S->f[0] != 0;
+}
+
 static inline int blake2b_set_lastblock( blake2b_state *S )
 {
   if( S->last_node ) blake2b_set_lastnode( S );
@@ -355,6 +360,9 @@ int blake2b_final( blake2b_state *S, uint8_t *out, uint8_t outlen )
   if( outlen > BLAKE2B_OUTBYTES )
     return -1;
 
+  if( blake2b_is_lastblock( S ) )
+    return -1;
+
   if( S->buflen > BLAKE2B_BLOCKBYTES )
   {
     blake2b_increment_counter( S, BLAKE2B_BLOCKBYTES );
diff --git a/sse/blake2s.c b/sse/blake2s.c
index 326efc6..59d6cca 100644
--- a/sse/blake2s.c
+++ b/sse/blake2s.c
@@ -73,6 +73,11 @@ static inline int blake2s_clear_lastnode( blake2s_state *S )
   return 0;
 }
 
+static inline int blake2s_is_lastblock( const blake2s_state *S )
+{
+  return S->f[0] != 0;
+}
+
 static inline int blake2s_set_lastblock( blake2s_state *S )
 {
   if( S->last_node ) blake2s_set_lastnode( S );
@@ -333,6 +338,9 @@ int blake2s_final( blake2s_state *S, uint8_t *out, uint8_t outlen )
   if( outlen > BLAKE2S_OUTBYTES )
     return -1;
 
+  if( blake2s_is_lastblock( S ) )
+    return -1;
+
   if( S->buflen > BLAKE2S_BLOCKBYTES )
   {
     blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );