blake2*_final() should return an error if called twice

2 files changed, 16 insertions, 0 deletions

diff --git a/sse/blake2b.c b/sse/blake2b.c
index 2d4a17b..1eba735 100644
--- a/sse/blake2b.c
+++ b/sse/blake2b.c
@@ -79,6 +79,11 @@ static inline int blake2b_clear_lastnode( blake2b_state *S )
   return 0;
 }
 
+static inline int blake2b_is_lastblock( const blake2b_state *S )
+{
+  return S->f[0] != 0;
+}
+
 static inline int blake2b_set_lastblock( blake2b_state *S )
 {
   if( S->last_node ) blake2b_set_lastnode( S );
@@ -355,6 +360,9 @@ int blake2b_final( blake2b_state *S, uint8_t *out, uint8_t outlen )
   if( outlen > BLAKE2B_OUTBYTES )
     return -1;
 
+  if( blake2b_is_lastblock( S ) )
+    return -1;
+
   if( S->buflen > BLAKE2B_BLOCKBYTES )
   {
     blake2b_increment_counter( S, BLAKE2B_BLOCKBYTES );
diff --git a/sse/blake2s.c b/sse/blake2s.c
index 326efc6..59d6cca 100644
--- a/sse/blake2s.c
+++ b/sse/blake2s.c
@@ -73,6 +73,11 @@ static inline int blake2s_clear_lastnode( blake2s_state *S )
   return 0;
 }
 
+static inline int blake2s_is_lastblock( const blake2s_state *S )
+{
+  return S->f[0] != 0;
+}
+
 static inline int blake2s_set_lastblock( blake2s_state *S )
 {
   if( S->last_node ) blake2s_set_lastnode( S );
@@ -333,6 +338,9 @@ int blake2s_final( blake2s_state *S, uint8_t *out, uint8_t outlen )
   if( outlen > BLAKE2S_OUTBYTES )
     return -1;
 
+  if( blake2s_is_lastblock( S ) )
+    return -1;
+
   if( S->buflen > BLAKE2S_BLOCKBYTES )
   {
     blake2s_increment_counter( S, BLAKE2S_BLOCKBYTES );