2 files changed, 7 insertions, 0 deletions

diff --git a/ChangeLog b/ChangeLog
index 3ed3a2839..eda55cf57 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -47,6 +47,7 @@
      use -Ocheck and waiting for completions by PID to make multiplexing test
      less racy and (hopefully) more reliable on slow hardware.
  - [Makefile umac.c] Add special-case target to build umac128.o.
+ - [umac.c] Enforce allowed umac output sizes.  From djm@.
 
 20120917
  - (dtucker) OpenBSD CVS Sync
diff --git a/umac.c b/umac.c
index e373de5be..0567c37f9 100644
--- a/umac.c
+++ b/umac.c
@@ -55,6 +55,12 @@
 #ifndef UMAC_OUTPUT_LEN
 #define UMAC_OUTPUT_LEN     8  /* Alowable: 4, 8, 12, 16                  */
 #endif
+
+#if UMAC_OUTPUT_LEN != 4 && UMAC_OUTPUT_LEN != 8 && \
+    UMAC_OUTPUT_LEN != 12 && UMAC_OUTPUT_LEN != 16
+# error UMAC_OUTPUT_LEN must be defined to 4, 8, 12 or 16
+#endif
+
 /* #define FORCE_C_ONLY        1  ANSI C and 64-bit integers req'd        */
 /* #define AES_IMPLEMENTAION   1  1 = OpenSSL, 2 = Barreto, 3 = Gladman   */
 /* #define SSE2                0  Is SSE2 is available?                   */