fixed retreatCounter added bounds check.

2 files changed, 12 insertions, 2 deletions

diff --git a/core/src/main/java/org/bouncycastle/crypto/engines/ChaChaEngine.java b/core/src/main/java/org/bouncycastle/crypto/engines/ChaChaEngine.java
index f2e04209..31da795f 100644
--- a/core/src/main/java/org/bouncycastle/crypto/engines/ChaChaEngine.java
+++ b/core/src/main/java/org/bouncycastle/crypto/engines/ChaChaEngine.java
@@ -39,7 +39,12 @@ public class ChaChaEngine extends Salsa20Engine
 
     protected void retreatCounter()
     {
-        if (--engineState[12] == Integer.MIN_VALUE)
+        if (engineState[12] == 0 && engineState[13] == 0)
+        {
+            throw new IllegalStateException("attempt to reduce counter past zero.");
+        }
+
+        if (--engineState[12] == -1)
         {
             --engineState[13];
         }
diff --git a/core/src/main/java/org/bouncycastle/crypto/engines/Salsa20Engine.java b/core/src/main/java/org/bouncycastle/crypto/engines/Salsa20Engine.java
index a6acc96f..1452d1e6 100644
--- a/core/src/main/java/org/bouncycastle/crypto/engines/Salsa20Engine.java
+++ b/core/src/main/java/org/bouncycastle/crypto/engines/Salsa20Engine.java
@@ -164,7 +164,12 @@ public class Salsa20Engine
 
     protected void retreatCounter()
     {
-        if (--engineState[8] == Integer.MIN_VALUE)
+        if (engineState[8] == 0 && engineState[9] == 0)
+        {
+            throw new IllegalStateException("attempt to reduce counter past zero.");
+        }
+
+        if (--engineState[8] == -1)
         {
             --engineState[9];
         }