Fix bad MAC padding length calculation

- affected files with data or AAD length >~2GB
- see also https://github.com/bcgit/bc-java/issues/673
- also allow null output buffer

1 files changed, 8 insertions, 2 deletions

diff --git a/crypto/src/crypto/modes/ChaCha20Poly1305.cs b/crypto/src/crypto/modes/ChaCha20Poly1305.cs
index 9cc62174c..6ca32d9c6 100644
--- a/crypto/src/crypto/modes/ChaCha20Poly1305.cs
+++ b/crypto/src/crypto/modes/ChaCha20Poly1305.cs
@@ -251,8 +251,14 @@ namespace Org.BouncyCastle.Crypto.Modes
         {
             if (null == inBytes)
                 throw new ArgumentNullException("inBytes");
+            /*
+             * Following bc-java, we allow null when no output is expected (e.g. based on a
+             * GetUpdateOutputSize call).
+             */
             if (null == outBytes)
-                throw new ArgumentNullException("outBytes");
+            {
+                //throw new ArgumentNullException("outBytes");
+            }
             if (inOff < 0)
                 throw new ArgumentException("cannot be negative", "inOff");
             if (len < 0)
@@ -487,7 +493,7 @@ namespace Org.BouncyCastle.Crypto.Modes
 
         private void PadMac(ulong count)
         {
-            int partial = (int)count % MacSize;
+            int partial = (int)count & (MacSize - 1);
             if (0 != partial)
             {
                 mPoly1305.BlockUpdate(Zeroes, 0, MacSize - partial);