PK11_DecryptWithSymKey and PK11_EncryptWithSymKey have been

mozilla/security/nss/lib/freebl/gcm.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #ifdef FREEBL_NO_DEPEND
 #include "stubs.h"
 #endif
 #include "blapii.h"
 #include "blapit.h"
 #include "gcm.h"
@@ skipping 435 matching lines @@
 {
     unsigned int blocks;
     SECStatus rv;
 
     ghash->cLen += (len*PR_BITS_PER_BYTE);
 
     /* first deal with the current buffer of data. Try to fill it out so
      * we can hash it */
     if (ghash->bufLen) {
         unsigned int needed = PR_MIN(len, blocksize - ghash->bufLen);
-        PORT_Memcpy(ghash->buffer+ghash->bufLen, buf, needed);
+        if (needed != 0) {
+            PORT_Memcpy(ghash->buffer+ghash->bufLen, buf, needed);
+        }
         buf += needed;
         len -= needed;
         ghash->bufLen += needed;
         if (len == 0) {
             /* didn't add enough to hash the data, nothing more do do */
             return SECSuccess;
         }
         PORT_Assert(ghash->bufLen == blocksize);
         /* hash the buffer and clear it */
         rv = gcm_HashMult(ghash, ghash->buffer, 1, blocksize);
@@ skipping 340 matching lines @@
     SECStatus rv;
     unsigned int tagBytes;
     unsigned char tag[MAX_BLOCK_SIZE];
     const unsigned char *intag;
     unsigned int len;
 
     tagBytes = (gcm->tagBits + (PR_BITS_PER_BYTE-1)) / PR_BITS_PER_BYTE;
 
     /* get the authentication block */
     if (inlen < tagBytes) {
-        PORT_SetError(SEC_ERROR_INVALID_ARGS);
+        PORT_SetError(SEC_ERROR_INPUT_LEN);
         return SECFailure;
     }
 
     inlen -= tagBytes;
     intag = inbuf + inlen;
 
     /* verify the block */
     rv = gcmHash_Update(&gcm->ghash_context, inbuf, inlen, blocksize);
     if (rv != SECSuccess) {
         return SECFailure;
     }
     rv = gcm_GetTag(gcm, tag, &len, blocksize, blocksize);
     if (rv != SECSuccess) {
         return SECFailure;
     }
     /* Don't decrypt if we can't authenticate the encrypted data!
      * This assumes that if tagBits is not a multiple of 8, intag will
      * preserve the masked off missing bits.  */
     if (NSS_SecureMemcmp(tag, intag, tagBytes) != 0) {
         /* force a CKR_ENCRYPTED_DATA_INVALID error at in softoken */
         PORT_SetError(SEC_ERROR_BAD_DATA);
         return SECFailure;
     }
     /* finish the decryption */
     return CTR_Update(&gcm->ctr_context, outbuf, outlen, maxout,
                           inbuf, inlen, blocksize);
 }