From c06f95e7cb8289ee59d00afa34cb7f0fadf76036 Mon Sep 17 00:00:00 2001
From: Colton Willey <colton@wolfssl.com>
Date: Tue, 22 Jul 2025 14:17:29 -0700
Subject: [PATCH 1/2] Error on auth tag failure for AES-GCM decrypt with FIPS

---
 src/wp_aes_aead.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wp_aes_aead.c b/src/wp_aes_aead.c
index 2bc717f0..a6d2c0be 100644
--- a/src/wp_aes_aead.c
+++ b/src/wp_aes_aead.c
@@ -1403,7 +1403,7 @@ static int wp_aesgcm_encdec(wp_AeadCtx *ctx, unsigned char *out, size_t* outLen,
                     ctx->aad, (word32)ctx->aadLen);
                 if (rc == AES_GCM_AUTH_E) {
                     ctx->authErr = 1;
-                    rc = 0;
+                    ok = 0;
                 }
                 if (rc != 0) {
                     ok = 0;

From 0a2c9f38e387a925dd8629ea985dc035e501eb0f Mon Sep 17 00:00:00 2001
From: Colton Willey <colton@wolfssl.com>
Date: Tue, 22 Jul 2025 16:13:26 -0700
Subject: [PATCH 2/2] Use existing check

---
 src/wp_aes_aead.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/wp_aes_aead.c b/src/wp_aes_aead.c
index a6d2c0be..61f58ff3 100644
--- a/src/wp_aes_aead.c
+++ b/src/wp_aes_aead.c
@@ -1403,7 +1403,6 @@ static int wp_aesgcm_encdec(wp_AeadCtx *ctx, unsigned char *out, size_t* outLen,
                     ctx->aad, (word32)ctx->aadLen);
                 if (rc == AES_GCM_AUTH_E) {
                     ctx->authErr = 1;
-                    ok = 0;
                 }
                 if (rc != 0) {
                     ok = 0;