From 16179b87f3909938fe3823cc47ac6d4449d15605 Mon Sep 17 00:00:00 2001
From: Frank Denis <github@pureftpd.org>
Date: Sat, 29 Jul 2017 17:39:31 +0200
Subject: [PATCH] Introduce *_BYTES_MAX constants

*_BYTES_MAX constants constants represent the maximum size of
a message.

No accessor functions for now. They will be renamed, as the
*_BYTES_MAX suffix was previously also used for the maximum output
size of stream ciphers.

These macros are designed to be used by language bindings, so they
can perform some sanity checks before calling the sodium API.
---
 .../aes256gcm/aesni/aead_aes256gcm_aesni.c    |  4 ++--
 .../sodium/aead_chacha20poly1305.c            |  4 ++--
 src/libsodium/crypto_box/crypto_box_easy.c    |  4 ++--
 .../box_curve25519xchacha20poly1305.c         |  4 ++--
 .../scryptsalsa208sha256/pbkdf2-sha256.c      |  3 +++
 .../crypto_secretbox/crypto_secretbox_easy.c  |  2 +-
 .../secretbox_xchacha20poly1305.c             |  2 +-
 .../crypto_sign/ed25519/ref10/obsolete.c      |  2 +-
 .../crypto_sign/ed25519/ref10/open.c          |  2 +-
 .../chacha20/dolbeau/chacha20_dolbeau-avx2.c  |  2 +-
 .../chacha20/dolbeau/chacha20_dolbeau-ssse3.c |  2 +-
 .../crypto_stream/chacha20/ref/chacha20_ref.c |  2 +-
 .../include/sodium/crypto_aead_aes256gcm.h    |  4 ++++
 .../sodium/crypto_aead_chacha20poly1305.h     |  7 ++++++
 .../sodium/crypto_aead_xchacha20poly1305.h    |  3 +++
 src/libsodium/include/sodium/crypto_box.h     |  2 ++
 .../crypto_box_curve25519xchacha20poly1305.h  |  4 ++++
 .../crypto_box_curve25519xsalsa20poly1305.h   |  6 +++++
 .../include/sodium/crypto_pwhash_argon2i.h    |  3 ++-
 .../include/sodium/crypto_pwhash_argon2id.h   |  3 ++-
 .../crypto_pwhash_scryptsalsa208sha256.h      |  8 ++++---
 .../include/sodium/crypto_secretbox.h         |  2 ++
 .../crypto_secretbox_xchacha20poly1305.h      |  4 ++++
 .../crypto_secretbox_xsalsa20poly1305.h       | 24 ++++++++++++-------
 src/libsodium/include/sodium/crypto_sign.h    |  2 ++
 .../include/sodium/crypto_sign_ed25519.h      |  2 ++
 .../crypto_sign_edwards25519sha512batch.h     |  1 +
 src/libsodium/include/sodium/crypto_stream.h  |  2 ++
 .../include/sodium/crypto_stream_aes128ctr.h  |  3 +++
 .../include/sodium/crypto_stream_chacha20.h   |  6 +++++
 .../include/sodium/crypto_stream_salsa20.h    |  2 ++
 .../include/sodium/crypto_stream_salsa2012.h  |  2 ++
 .../include/sodium/crypto_stream_salsa208.h   |  2 ++
 .../include/sodium/crypto_stream_xchacha20.h  |  2 ++
 .../include/sodium/crypto_stream_xsalsa20.h   |  2 ++
 src/libsodium/include/sodium/export.h         |  3 +++
 src/libsodium/include/sodium/randombytes.h    |  2 ++
 src/libsodium/randombytes/randombytes.c       |  1 +
 .../sysrandom/randombytes_sysrandom.c         |  3 ++-
 39 files changed, 108 insertions(+), 30 deletions(-)

diff --git a/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c b/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c
index 1e787f3f..99c6fe48 100644
--- a/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c
+++ b/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c
@@ -524,7 +524,7 @@ crypto_aead_aes256gcm_encrypt_detached_afternm(unsigned char *c,
 
     (void) nsec;
     memcpy(H, ctx->H, sizeof H);
-    if (mlen > 16ULL * ((1ULL << 32) - 2)) {
+    if (mlen > crypto_aead_aes256gcm_BYTES_MAX) {
         sodium_misuse(); /* LCOV_EXCL_LINE */
     }
     memcpy(&n2[0], npub, 3 * 4);
@@ -662,7 +662,7 @@ crypto_aead_aes256gcm_decrypt_detached_afternm(unsigned char *m, unsigned char *
     CRYPTO_ALIGN(16) unsigned char fb[16];
 
     (void) nsec;
-    if (clen > 16ULL * (1ULL << 32)) {
+    if (clen > crypto_aead_aes256gcm_BYTES_MAX) {
         sodium_misuse(); /* LCOV_EXCL_LINE */
     }
     mlen = clen;
diff --git a/src/libsodium/crypto_aead/chacha20poly1305/sodium/aead_chacha20poly1305.c b/src/libsodium/crypto_aead/chacha20poly1305/sodium/aead_chacha20poly1305.c
index cd5c3484..b14f171c 100644
--- a/src/libsodium/crypto_aead/chacha20poly1305/sodium/aead_chacha20poly1305.c
+++ b/src/libsodium/crypto_aead/chacha20poly1305/sodium/aead_chacha20poly1305.c
@@ -70,7 +70,7 @@ crypto_aead_chacha20poly1305_encrypt(unsigned char *c,
     unsigned long long clen = 0ULL;
     int                ret;
 
-    if (mlen > UINT64_MAX - crypto_aead_chacha20poly1305_ABYTES) {
+    if (mlen > crypto_aead_chacha20poly1305_BYTES_MAX) {
         sodium_misuse();
     }
     ret = crypto_aead_chacha20poly1305_encrypt_detached(c,
@@ -145,7 +145,7 @@ crypto_aead_chacha20poly1305_ietf_encrypt(unsigned char *c,
     unsigned long long clen = 0ULL;
     int                ret;
 
-    if (mlen > UINT64_MAX - crypto_aead_chacha20poly1305_ietf_ABYTES) {
+    if (mlen > crypto_aead_chacha20poly1305_ietf_BYTES_MAX) {
         sodium_misuse();
     }
     ret = crypto_aead_chacha20poly1305_ietf_encrypt_detached(c,
diff --git a/src/libsodium/crypto_box/crypto_box_easy.c b/src/libsodium/crypto_box/crypto_box_easy.c
index 364a359c..0aca0519 100644
--- a/src/libsodium/crypto_box/crypto_box_easy.c
+++ b/src/libsodium/crypto_box/crypto_box_easy.c
@@ -40,7 +40,7 @@ crypto_box_easy_afternm(unsigned char *c, const unsigned char *m,
                         unsigned long long mlen, const unsigned char *n,
                         const unsigned char *k)
 {
-    if (mlen > SIZE_MAX - crypto_box_MACBYTES) {
+    if (mlen > crypto_box_BYTES_MAX) {
         return -1;
     }
     return crypto_box_detached_afternm(c + crypto_box_MACBYTES, c, m, mlen, n,
@@ -52,7 +52,7 @@ crypto_box_easy(unsigned char *c, const unsigned char *m,
                 unsigned long long mlen, const unsigned char *n,
                 const unsigned char *pk, const unsigned char *sk)
 {
-    if (mlen > SIZE_MAX - crypto_box_MACBYTES) {
+    if (mlen > crypto_box_BYTES_MAX) {
         return -1;
     }
     return crypto_box_detached(c + crypto_box_MACBYTES, c, m, mlen, n,
diff --git a/src/libsodium/crypto_box/curve25519xchacha20poly1305/box_curve25519xchacha20poly1305.c b/src/libsodium/crypto_box/curve25519xchacha20poly1305/box_curve25519xchacha20poly1305.c
index 1a4d26be..142708bf 100644
--- a/src/libsodium/crypto_box/curve25519xchacha20poly1305/box_curve25519xchacha20poly1305.c
+++ b/src/libsodium/crypto_box/curve25519xchacha20poly1305/box_curve25519xchacha20poly1305.c
@@ -86,7 +86,7 @@ crypto_box_curve25519xchacha20poly1305_easy_afternm(unsigned char *c,
                                                     const unsigned char *n,
                                                     const unsigned char *k)
 {
-    if (mlen > SIZE_MAX - crypto_box_curve25519xchacha20poly1305_MACBYTES) {
+    if (mlen > crypto_box_curve25519xchacha20poly1305_BYTES_MAX) {
         return -1;
     }
     return crypto_box_curve25519xchacha20poly1305_detached_afternm(
@@ -98,7 +98,7 @@ crypto_box_curve25519xchacha20poly1305_easy(
     unsigned char *c, const unsigned char *m, unsigned long long mlen,
     const unsigned char *n, const unsigned char *pk, const unsigned char *sk)
 {
-    if (mlen > SIZE_MAX - crypto_box_curve25519xchacha20poly1305_MACBYTES) {
+    if (mlen > crypto_box_curve25519xchacha20poly1305_BYTES_MAX) {
         return -1;
     }
     return crypto_box_curve25519xchacha20poly1305_detached(
diff --git a/src/libsodium/crypto_pwhash/scryptsalsa208sha256/pbkdf2-sha256.c b/src/libsodium/crypto_pwhash/scryptsalsa208sha256/pbkdf2-sha256.c
index 7a5a6988..42cab61f 100644
--- a/src/libsodium/crypto_pwhash/scryptsalsa208sha256/pbkdf2-sha256.c
+++ b/src/libsodium/crypto_pwhash/scryptsalsa208sha256/pbkdf2-sha256.c
@@ -33,6 +33,7 @@
 
 #include "core.h"
 #include "crypto_auth_hmacsha256.h"
+#include "crypto_pwhash_scryptsalsa208sha256.h"
 #include "pbkdf2-sha256.h"
 #include "private/common.h"
 #include "utils.h"
@@ -56,6 +57,8 @@ PBKDF2_SHA256(const uint8_t *passwd, size_t passwdlen, const uint8_t *salt,
     size_t                       clen;
 
 #if SIZE_MAX > 0x1fffffffe0ULL
+    COMPILER_ASSERT(crypto_pwhash_scryptsalsa208sha256_BYTES_MAX
+                    <= 0x1fffffffe0ULL);
     if (dkLen > 0x1fffffffe0ULL) {
         sodium_misuse(); /* LCOV_EXCL_LINE */
     }
diff --git a/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c b/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c
index e4e7c72d..2c7cbf95 100644
--- a/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c
+++ b/src/libsodium/crypto_secretbox/crypto_secretbox_easy.c
@@ -71,7 +71,7 @@ crypto_secretbox_easy(unsigned char *c, const unsigned char *m,
                       unsigned long long mlen, const unsigned char *n,
                       const unsigned char *k)
 {
-    if (mlen > SIZE_MAX - crypto_secretbox_MACBYTES) {
+    if (mlen > crypto_secretbox_BYTES_MAX) {
         return -1;
     }
     return crypto_secretbox_detached(c + crypto_secretbox_MACBYTES,
diff --git a/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c b/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c
index f7f6a4ea..e85e9197 100644
--- a/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c
+++ b/src/libsodium/crypto_secretbox/xchacha20poly1305/secretbox_xchacha20poly1305.c
@@ -77,7 +77,7 @@ crypto_secretbox_xchacha20poly1305_easy(unsigned char *c,
                                         const unsigned char *n,
                                         const unsigned char *k)
 {
-    if (mlen > SIZE_MAX - crypto_secretbox_xchacha20poly1305_MACBYTES) {
+    if (mlen > crypto_secretbox_xchacha20poly1305_BYTES_MAX) {
         return -1;
     }
     return crypto_secretbox_xchacha20poly1305_detached
diff --git a/src/libsodium/crypto_sign/ed25519/ref10/obsolete.c b/src/libsodium/crypto_sign/ed25519/ref10/obsolete.c
index c572ff11..b074889e 100644
--- a/src/libsodium/crypto_sign/ed25519/ref10/obsolete.c
+++ b/src/libsodium/crypto_sign/ed25519/ref10/obsolete.c
@@ -83,7 +83,7 @@ crypto_sign_edwards25519sha512batch_open(unsigned char       *m,
     ge_p3              cs3;
 
     *mlen_p = 0;
-    if (smlen < 64 || smlen > SIZE_MAX) {
+    if (smlen < 64 || smlen - 64 > crypto_sign_edwards25519sha512batch_BYTES_MAX) {
         return -1;
     }
     mlen = smlen - 64;
diff --git a/src/libsodium/crypto_sign/ed25519/ref10/open.c b/src/libsodium/crypto_sign/ed25519/ref10/open.c
index 18c343e8..ff1684ae 100644
--- a/src/libsodium/crypto_sign/ed25519/ref10/open.c
+++ b/src/libsodium/crypto_sign/ed25519/ref10/open.c
@@ -171,7 +171,7 @@ crypto_sign_ed25519_open(unsigned char *m, unsigned long long *mlen_p,
 {
     unsigned long long mlen;
 
-    if (smlen < 64 || smlen > SIZE_MAX) {
+    if (smlen < 64 || smlen - 64 > crypto_sign_ed25519_BYTES_MAX) {
         goto badsig;
     }
     mlen = smlen - 64;
diff --git a/src/libsodium/crypto_stream/chacha20/dolbeau/chacha20_dolbeau-avx2.c b/src/libsodium/crypto_stream/chacha20/dolbeau/chacha20_dolbeau-avx2.c
index 4db4395d..a472e3f1 100644
--- a/src/libsodium/crypto_stream/chacha20/dolbeau/chacha20_dolbeau-avx2.c
+++ b/src/libsodium/crypto_stream/chacha20/dolbeau/chacha20_dolbeau-avx2.c
@@ -77,7 +77,7 @@ chacha20_encrypt_bytes(chacha_ctx *ctx, const uint8_t *m, uint8_t *c,
     if (!bytes) {
         return; /* LCOV_EXCL_LINE */
     }
-    if (bytes > 64ULL * (1ULL << 32) - 64ULL) {
+    if (bytes > crypto_stream_chacha20_BYTES_MAX) {
         sodium_misuse();
     }
 # include "u8.h"
diff --git a/src/libsodium/crypto_stream/chacha20/dolbeau/chacha20_dolbeau-ssse3.c b/src/libsodium/crypto_stream/chacha20/dolbeau/chacha20_dolbeau-ssse3.c
index 0c6b5af3..55629c34 100644
--- a/src/libsodium/crypto_stream/chacha20/dolbeau/chacha20_dolbeau-ssse3.c
+++ b/src/libsodium/crypto_stream/chacha20/dolbeau/chacha20_dolbeau-ssse3.c
@@ -72,7 +72,7 @@ chacha20_encrypt_bytes(chacha_ctx *ctx, const uint8_t *m, uint8_t *c,
     if (!bytes) {
         return; /* LCOV_EXCL_LINE */
     }
-    if (bytes > 64ULL * (1ULL << 32) - 64ULL) {
+    if (bytes > crypto_stream_chacha20_BYTES_MAX) {
         sodium_misuse();
     }
 # include "u4.h"
diff --git a/src/libsodium/crypto_stream/chacha20/ref/chacha20_ref.c b/src/libsodium/crypto_stream/chacha20/ref/chacha20_ref.c
index 2eee3b2c..297d299c 100644
--- a/src/libsodium/crypto_stream/chacha20/ref/chacha20_ref.c
+++ b/src/libsodium/crypto_stream/chacha20/ref/chacha20_ref.c
@@ -92,7 +92,7 @@ chacha20_encrypt_bytes(chacha_ctx *ctx, const uint8_t *m, uint8_t *c,
     if (!bytes) {
         return; /* LCOV_EXCL_LINE */
     }
-    if (bytes > 64ULL * (1ULL << 32) - 64ULL) {
+    if (bytes > crypto_stream_chacha20_BYTES_MAX) {
         sodium_misuse();
     }
     j0  = ctx->input[0];
diff --git a/src/libsodium/include/sodium/crypto_aead_aes256gcm.h b/src/libsodium/include/sodium/crypto_aead_aes256gcm.h
index 972df54f..a6f12aaa 100644
--- a/src/libsodium/include/sodium/crypto_aead_aes256gcm.h
+++ b/src/libsodium/include/sodium/crypto_aead_aes256gcm.h
@@ -30,6 +30,10 @@ size_t crypto_aead_aes256gcm_npubbytes(void);
 SODIUM_EXPORT
 size_t crypto_aead_aes256gcm_abytes(void);
 
+#define crypto_aead_aes256gcm_BYTES_MAX \
+    SODIUM_MIN(SODIUM_SIZE_MAX - crypto_aead_aes256gcm_ABYTES, \
+               (16ULL * ((1ULL << 32) - 2ULL)) - crypto_aead_aes256gcm_ABYTES)
+
 typedef CRYPTO_ALIGN(16) unsigned char crypto_aead_aes256gcm_state[512];
 
 SODIUM_EXPORT
diff --git a/src/libsodium/include/sodium/crypto_aead_chacha20poly1305.h b/src/libsodium/include/sodium/crypto_aead_chacha20poly1305.h
index 0bbc6885..1617a138 100644
--- a/src/libsodium/include/sodium/crypto_aead_chacha20poly1305.h
+++ b/src/libsodium/include/sodium/crypto_aead_chacha20poly1305.h
@@ -30,6 +30,10 @@ size_t crypto_aead_chacha20poly1305_ietf_npubbytes(void);
 SODIUM_EXPORT
 size_t crypto_aead_chacha20poly1305_ietf_abytes(void);
 
+#define crypto_aead_chacha20poly1305_ietf_BYTES_MAX \
+    SODIUM_MIN(SODIUM_SIZE_MAX - crypto_aead_chacha20poly1305_ietf_ABYTES, \
+               (64ULL * (1ULL << 32) - 64ULL) - crypto_aead_chacha20poly1305_ietf_ABYTES)
+
 SODIUM_EXPORT
 int crypto_aead_chacha20poly1305_ietf_encrypt(unsigned char *c,
                                               unsigned long long *clen_p,
@@ -98,6 +102,9 @@ size_t crypto_aead_chacha20poly1305_npubbytes(void);
 SODIUM_EXPORT
 size_t crypto_aead_chacha20poly1305_abytes(void);
 
+#define crypto_aead_chacha20poly1305_BYTES_MAX \
+    (SODIUM_SIZE_MAX - crypto_aead_chacha20poly1305_ABYTES)
+
 SODIUM_EXPORT
 int crypto_aead_chacha20poly1305_encrypt(unsigned char *c,
                                          unsigned long long *clen_p,
diff --git a/src/libsodium/include/sodium/crypto_aead_xchacha20poly1305.h b/src/libsodium/include/sodium/crypto_aead_xchacha20poly1305.h
index f863ce88..8c1224d5 100644
--- a/src/libsodium/include/sodium/crypto_aead_xchacha20poly1305.h
+++ b/src/libsodium/include/sodium/crypto_aead_xchacha20poly1305.h
@@ -27,6 +27,9 @@ size_t crypto_aead_xchacha20poly1305_ietf_npubbytes(void);
 SODIUM_EXPORT
 size_t crypto_aead_xchacha20poly1305_ietf_abytes(void);
 
+#define crypto_aead_xchacha20poly1305_ietf_BYTES_MAX \
+    (SODIUM_SIZE_MAX - crypto_aead_xchacha20poly1305_ietf_ABYTES)
+
 SODIUM_EXPORT
 int crypto_aead_xchacha20poly1305_ietf_encrypt(unsigned char *c,
                                                unsigned long long *clen_p,
diff --git a/src/libsodium/include/sodium/crypto_box.h b/src/libsodium/include/sodium/crypto_box.h
index 614cd1e0..1adf377b 100644
--- a/src/libsodium/include/sodium/crypto_box.h
+++ b/src/libsodium/include/sodium/crypto_box.h
@@ -40,6 +40,8 @@ size_t  crypto_box_noncebytes(void);
 SODIUM_EXPORT
 size_t  crypto_box_macbytes(void);
 
+#define crypto_box_BYTES_MAX crypto_box_curve25519xsalsa20poly1305_BYTES_MAX
+
 #define crypto_box_PRIMITIVE "curve25519xsalsa20poly1305"
 SODIUM_EXPORT
 const char *crypto_box_primitive(void);
diff --git a/src/libsodium/include/sodium/crypto_box_curve25519xchacha20poly1305.h b/src/libsodium/include/sodium/crypto_box_curve25519xchacha20poly1305.h
index b781cc6e..6fd8e987 100644
--- a/src/libsodium/include/sodium/crypto_box_curve25519xchacha20poly1305.h
+++ b/src/libsodium/include/sodium/crypto_box_curve25519xchacha20poly1305.h
@@ -3,6 +3,7 @@
 #define crypto_box_curve25519xchacha20poly1305_H
 
 #include <stddef.h>
+#include "crypto_stream_xchacha20.h"
 #include "export.h"
 
 #ifdef __cplusplus
@@ -36,6 +37,9 @@ size_t crypto_box_curve25519xchacha20poly1305_noncebytes(void);
 SODIUM_EXPORT
 size_t crypto_box_curve25519xchacha20poly1305_macbytes(void);
 
+#define crypto_box_curve25519xchacha20poly1305_BYTES_MAX \
+    (crypto_stream_xchacha20_BYTES_MAX - crypto_box_curve25519xchacha20poly1305_MACBYTES)
+
 SODIUM_EXPORT
 int crypto_box_curve25519xchacha20poly1305_seed_keypair(unsigned char *pk,
                                                         unsigned char *sk,
diff --git a/src/libsodium/include/sodium/crypto_box_curve25519xsalsa20poly1305.h b/src/libsodium/include/sodium/crypto_box_curve25519xsalsa20poly1305.h
index 9b5a39c3..e9491a82 100644
--- a/src/libsodium/include/sodium/crypto_box_curve25519xsalsa20poly1305.h
+++ b/src/libsodium/include/sodium/crypto_box_curve25519xsalsa20poly1305.h
@@ -2,6 +2,7 @@
 #define crypto_box_curve25519xsalsa20poly1305_H
 
 #include <stddef.h>
+#include "crypto_stream_xsalsa20.h"
 #include "export.h"
 
 #ifdef __cplusplus
@@ -11,6 +12,8 @@
 extern "C" {
 #endif
 
+/* -- NaCl compatibility interface ; Requires padding -- */
+
 #define crypto_box_curve25519xsalsa20poly1305_SEEDBYTES 32U
 SODIUM_EXPORT
 size_t crypto_box_curve25519xsalsa20poly1305_seedbytes(void);
@@ -45,6 +48,9 @@ size_t crypto_box_curve25519xsalsa20poly1305_boxzerobytes(void);
 SODIUM_EXPORT
 size_t crypto_box_curve25519xsalsa20poly1305_zerobytes(void);
 
+#define crypto_box_curve25519xsalsa20poly1305_BYTES_MAX \
+    (crypto_stream_xsalsa20_BYTES_MAX - crypto_box_curve25519xsalsa20poly1305_ZEROBYTES)
+
 SODIUM_EXPORT
 int crypto_box_curve25519xsalsa20poly1305(unsigned char *c,
                                           const unsigned char *m,
diff --git a/src/libsodium/include/sodium/crypto_pwhash_argon2i.h b/src/libsodium/include/sodium/crypto_pwhash_argon2i.h
index fed96587..a405f563 100644
--- a/src/libsodium/include/sodium/crypto_pwhash_argon2i.h
+++ b/src/libsodium/include/sodium/crypto_pwhash_argon2i.h
@@ -58,7 +58,8 @@ size_t crypto_pwhash_argon2i_opslimit_max(void);
 SODIUM_EXPORT
 size_t crypto_pwhash_argon2i_memlimit_min(void);
 
-#define crypto_pwhash_argon2i_MEMLIMIT_MAX ((SIZE_MAX >= 4398046510080U) ? 4398046510080U : (SIZE_MAX >= 2147483648U) ? 2147483648U : 32768U)
+#define crypto_pwhash_argon2i_MEMLIMIT_MAX \
+    ((SIZE_MAX >= 4398046510080U) ? 4398046510080U : (SIZE_MAX >= 2147483648U) ? 2147483648U : 32768U)
 SODIUM_EXPORT
 size_t crypto_pwhash_argon2i_memlimit_max(void);
 
diff --git a/src/libsodium/include/sodium/crypto_pwhash_argon2id.h b/src/libsodium/include/sodium/crypto_pwhash_argon2id.h
index 550fd6fd..46432cd2 100644
--- a/src/libsodium/include/sodium/crypto_pwhash_argon2id.h
+++ b/src/libsodium/include/sodium/crypto_pwhash_argon2id.h
@@ -58,7 +58,8 @@ size_t crypto_pwhash_argon2id_opslimit_max(void);
 SODIUM_EXPORT
 size_t crypto_pwhash_argon2id_memlimit_min(void);
 
-#define crypto_pwhash_argon2id_MEMLIMIT_MAX ((SIZE_MAX >= 4398046510080U) ? 4398046510080U : (SIZE_MAX >= 2147483648U) ? 2147483648U : 32768U)
+#define crypto_pwhash_argon2id_MEMLIMIT_MAX \
+    ((SIZE_MAX >= 4398046510080U) ? 4398046510080U : (SIZE_MAX >= 2147483648U) ? 2147483648U : 32768U)
 SODIUM_EXPORT
 size_t crypto_pwhash_argon2id_memlimit_max(void);
 
diff --git a/src/libsodium/include/sodium/crypto_pwhash_scryptsalsa208sha256.h b/src/libsodium/include/sodium/crypto_pwhash_scryptsalsa208sha256.h
index 987f123f..fcaa3603 100644
--- a/src/libsodium/include/sodium/crypto_pwhash_scryptsalsa208sha256.h
+++ b/src/libsodium/include/sodium/crypto_pwhash_scryptsalsa208sha256.h
@@ -18,7 +18,8 @@ extern "C" {
 SODIUM_EXPORT
 size_t crypto_pwhash_scryptsalsa208sha256_bytes_min(void);
 
-#define crypto_pwhash_scryptsalsa208sha256_BYTES_MAX (SIZE_MAX > 0x1fffffffe0ULL ? 0x1fffffffe0ULL : SIZE_MAX)
+#define crypto_pwhash_scryptsalsa208sha256_BYTES_MAX \
+    SODIUM_MIN(SODIUM_SIZE_MAX, 0x1fffffffe0ULL)
 SODIUM_EXPORT
 size_t crypto_pwhash_scryptsalsa208sha256_bytes_max(void);
 
@@ -26,7 +27,7 @@ size_t crypto_pwhash_scryptsalsa208sha256_bytes_max(void);
 SODIUM_EXPORT
 size_t crypto_pwhash_scryptsalsa208sha256_passwd_min(void);
 
-#define crypto_pwhash_scryptsalsa208sha256_PASSWD_MAX SIZE_MAX
+#define crypto_pwhash_scryptsalsa208sha256_PASSWD_MAX SODIUM_SIZE_MAX
 SODIUM_EXPORT
 size_t crypto_pwhash_scryptsalsa208sha256_passwd_max(void);
 
@@ -54,7 +55,8 @@ size_t crypto_pwhash_scryptsalsa208sha256_opslimit_max(void);
 SODIUM_EXPORT
 size_t crypto_pwhash_scryptsalsa208sha256_memlimit_min(void);
 
-#define crypto_pwhash_scryptsalsa208sha256_MEMLIMIT_MAX ((SIZE_MAX >= 68719476736U) ? 68719476736U : SIZE_MAX)
+#define crypto_pwhash_scryptsalsa208sha256_MEMLIMIT_MAX \
+    SODIUM_MIN(SIZE_MAX, 68719476736ULL)
 SODIUM_EXPORT
 size_t crypto_pwhash_scryptsalsa208sha256_memlimit_max(void);
 
diff --git a/src/libsodium/include/sodium/crypto_secretbox.h b/src/libsodium/include/sodium/crypto_secretbox.h
index 9b098200..420a294f 100644
--- a/src/libsodium/include/sodium/crypto_secretbox.h
+++ b/src/libsodium/include/sodium/crypto_secretbox.h
@@ -29,6 +29,8 @@ size_t  crypto_secretbox_macbytes(void);
 SODIUM_EXPORT
 const char *crypto_secretbox_primitive(void);
 
+#define crypto_secretbox_BYTES_MAX crypto_secretbox_xsalsa20poly1305_BYTES_MAX
+
 SODIUM_EXPORT
 int crypto_secretbox_easy(unsigned char *c, const unsigned char *m,
                           unsigned long long mlen, const unsigned char *n,
diff --git a/src/libsodium/include/sodium/crypto_secretbox_xchacha20poly1305.h b/src/libsodium/include/sodium/crypto_secretbox_xchacha20poly1305.h
index 7a61a091..b8701197 100644
--- a/src/libsodium/include/sodium/crypto_secretbox_xchacha20poly1305.h
+++ b/src/libsodium/include/sodium/crypto_secretbox_xchacha20poly1305.h
@@ -2,6 +2,7 @@
 #define crypto_secretbox_xchacha20poly1305_H
 
 #include <stddef.h>
+#include "crypto_stream_xchacha20.h"
 #include "export.h"
 
 #ifdef __cplusplus
@@ -23,6 +24,9 @@ size_t crypto_secretbox_xchacha20poly1305_noncebytes(void);
 SODIUM_EXPORT
 size_t crypto_secretbox_xchacha20poly1305_macbytes(void);
 
+#define crypto_secretbox_xchacha20poly1305_BYTES_MAX \
+    (crypto_stream_xchacha20_BYTES_MAX - crypto_secretbox_xchacha20poly1305_MACBYTES)
+
 SODIUM_EXPORT
 int crypto_secretbox_xchacha20poly1305_easy(unsigned char *c,
                                             const unsigned char *m,
diff --git a/src/libsodium/include/sodium/crypto_secretbox_xsalsa20poly1305.h b/src/libsodium/include/sodium/crypto_secretbox_xsalsa20poly1305.h
index 5aa30805..36e4c114 100644
--- a/src/libsodium/include/sodium/crypto_secretbox_xsalsa20poly1305.h
+++ b/src/libsodium/include/sodium/crypto_secretbox_xsalsa20poly1305.h
@@ -2,6 +2,7 @@
 #define crypto_secretbox_xsalsa20poly1305_H
 
 #include <stddef.h>
+#include "crypto_stream_xsalsa20.h"
 #include "export.h"
 
 #ifdef __cplusplus
@@ -23,15 +24,8 @@ size_t crypto_secretbox_xsalsa20poly1305_noncebytes(void);
 SODIUM_EXPORT
 size_t crypto_secretbox_xsalsa20poly1305_macbytes(void);
 
-#define crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES 16U
-SODIUM_EXPORT
-size_t crypto_secretbox_xsalsa20poly1305_boxzerobytes(void);
-
-#define crypto_secretbox_xsalsa20poly1305_ZEROBYTES \
-    (crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES + \
-     crypto_secretbox_xsalsa20poly1305_MACBYTES)
-SODIUM_EXPORT
-size_t crypto_secretbox_xsalsa20poly1305_zerobytes(void);
+#define crypto_secretbox_xsalsa20poly1305_BYTES_MAX \
+    (crypto_stream_xsalsa20_BYTES_MAX - crypto_secretbox_xsalsa20poly1305_ZEROBYTES)
 
 SODIUM_EXPORT
 int crypto_secretbox_xsalsa20poly1305(unsigned char *c,
@@ -51,6 +45,18 @@ int crypto_secretbox_xsalsa20poly1305_open(unsigned char *m,
 SODIUM_EXPORT
 void crypto_secretbox_xsalsa20poly1305_keygen(unsigned char k[crypto_secretbox_xsalsa20poly1305_KEYBYTES]);
 
+/* -- NaCl compatibility interface ; Requires padding -- */
+
+#define crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES 16U
+SODIUM_EXPORT
+size_t crypto_secretbox_xsalsa20poly1305_boxzerobytes(void);
+
+#define crypto_secretbox_xsalsa20poly1305_ZEROBYTES \
+    (crypto_secretbox_xsalsa20poly1305_BOXZEROBYTES + \
+     crypto_secretbox_xsalsa20poly1305_MACBYTES)
+SODIUM_EXPORT
+size_t crypto_secretbox_xsalsa20poly1305_zerobytes(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/src/libsodium/include/sodium/crypto_sign.h b/src/libsodium/include/sodium/crypto_sign.h
index b0335bf2..64e95f99 100644
--- a/src/libsodium/include/sodium/crypto_sign.h
+++ b/src/libsodium/include/sodium/crypto_sign.h
@@ -41,6 +41,8 @@ size_t  crypto_sign_publickeybytes(void);
 SODIUM_EXPORT
 size_t  crypto_sign_secretkeybytes(void);
 
+#define crypto_sign_BYTES_MAX crypto_sign_ed25519_BYTES_MAX
+
 #define crypto_sign_PRIMITIVE "ed25519"
 SODIUM_EXPORT
 const char *crypto_sign_primitive(void);
diff --git a/src/libsodium/include/sodium/crypto_sign_ed25519.h b/src/libsodium/include/sodium/crypto_sign_ed25519.h
index 17c150f2..c6905c20 100644
--- a/src/libsodium/include/sodium/crypto_sign_ed25519.h
+++ b/src/libsodium/include/sodium/crypto_sign_ed25519.h
@@ -35,6 +35,8 @@ size_t crypto_sign_ed25519_publickeybytes(void);
 SODIUM_EXPORT
 size_t crypto_sign_ed25519_secretkeybytes(void);
 
+#define crypto_sign_ed25519_BYTES_MAX (SODIUM_SIZE_MAX - crypto_sign_ed25519_BYTES)
+
 SODIUM_EXPORT
 int crypto_sign_ed25519(unsigned char *sm, unsigned long long *smlen_p,
                         const unsigned char *m, unsigned long long mlen,
diff --git a/src/libsodium/include/sodium/crypto_sign_edwards25519sha512batch.h b/src/libsodium/include/sodium/crypto_sign_edwards25519sha512batch.h
index 2224a94e..50b51843 100644
--- a/src/libsodium/include/sodium/crypto_sign_edwards25519sha512batch.h
+++ b/src/libsodium/include/sodium/crypto_sign_edwards25519sha512batch.h
@@ -25,6 +25,7 @@ extern "C" {
 #define crypto_sign_edwards25519sha512batch_BYTES 64U
 #define crypto_sign_edwards25519sha512batch_PUBLICKEYBYTES 32U
 #define crypto_sign_edwards25519sha512batch_SECRETKEYBYTES (32U + 32U)
+#define crypto_sign_edwards25519sha512batch_BYTES_MAX (SODIUM_SIZE_MAX - crypto_sign_edwards25519sha512batch_BYTES)
 
 SODIUM_EXPORT
 int crypto_sign_edwards25519sha512batch(unsigned char *sm,
diff --git a/src/libsodium/include/sodium/crypto_stream.h b/src/libsodium/include/sodium/crypto_stream.h
index 22de6ff5..da3e165d 100644
--- a/src/libsodium/include/sodium/crypto_stream.h
+++ b/src/libsodium/include/sodium/crypto_stream.h
@@ -29,6 +29,8 @@ size_t  crypto_stream_keybytes(void);
 SODIUM_EXPORT
 size_t  crypto_stream_noncebytes(void);
 
+#define crypto_stream_BYTES_MAX crypto_stream_xsalsa20_BYTES_MAX
+
 #define crypto_stream_PRIMITIVE "xsalsa20"
 SODIUM_EXPORT
 const char *crypto_stream_primitive(void);
diff --git a/src/libsodium/include/sodium/crypto_stream_aes128ctr.h b/src/libsodium/include/sodium/crypto_stream_aes128ctr.h
index 33ee1b89..a65f1915 100644
--- a/src/libsodium/include/sodium/crypto_stream_aes128ctr.h
+++ b/src/libsodium/include/sodium/crypto_stream_aes128ctr.h
@@ -31,6 +31,9 @@ size_t crypto_stream_aes128ctr_noncebytes(void);
 SODIUM_EXPORT
 size_t crypto_stream_aes128ctr_beforenmbytes(void);
 
+#define crypto_stream_aes128ctr_SIZE_MAX \
+    SODIUM_MIN(SODIUM_SIZE_MAX, 16ULL * (1ULL << 32))
+
 SODIUM_EXPORT
 int crypto_stream_aes128ctr(unsigned char *out, unsigned long long outlen,
                             const unsigned char *n, const unsigned char *k)
diff --git a/src/libsodium/include/sodium/crypto_stream_chacha20.h b/src/libsodium/include/sodium/crypto_stream_chacha20.h
index 352b9290..d52e1812 100644
--- a/src/libsodium/include/sodium/crypto_stream_chacha20.h
+++ b/src/libsodium/include/sodium/crypto_stream_chacha20.h
@@ -28,6 +28,8 @@ size_t crypto_stream_chacha20_keybytes(void);
 SODIUM_EXPORT
 size_t crypto_stream_chacha20_noncebytes(void);
 
+#define crypto_stream_chacha20_BYTES_MAX SODIUM_SIZE_MAX
+
 /* ChaCha20 with a 64-bit nonce and a 64-bit counter, as originally designed */
 
 SODIUM_EXPORT
@@ -58,6 +60,9 @@ size_t crypto_stream_chacha20_ietf_keybytes(void);
 SODIUM_EXPORT
 size_t crypto_stream_chacha20_ietf_noncebytes(void);
 
+#define crypto_stream_chacha20_ietf_BYTES_MAX \
+    SODIUM_MIN(SODIUM_SIZE_MAX, 64ULL * (1ULL << 32))
+
 SODIUM_EXPORT
 int crypto_stream_chacha20_ietf(unsigned char *c, unsigned long long clen,
                                 const unsigned char *n, const unsigned char *k);
@@ -80,6 +85,7 @@ void crypto_stream_chacha20_ietf_keygen(unsigned char k[crypto_stream_chacha20_i
 
 #define crypto_stream_chacha20_IETF_KEYBYTES crypto_stream_chacha20_ietf_KEYBYTES
 #define crypto_stream_chacha20_IETF_NONCEBYTES crypto_stream_chacha20_ietf_NONCEBYTES
+#define crypto_stream_chacha20_IETF_BYTES_MAX crypto_stream_chacha20_ietf_BYTES_MAX
 
 #ifdef __cplusplus
 }
diff --git a/src/libsodium/include/sodium/crypto_stream_salsa20.h b/src/libsodium/include/sodium/crypto_stream_salsa20.h
index 961e5c1c..4bbc9251 100644
--- a/src/libsodium/include/sodium/crypto_stream_salsa20.h
+++ b/src/libsodium/include/sodium/crypto_stream_salsa20.h
@@ -28,6 +28,8 @@ size_t crypto_stream_salsa20_keybytes(void);
 SODIUM_EXPORT
 size_t crypto_stream_salsa20_noncebytes(void);
 
+#define crypto_stream_salsa20_BYTES_MAX SODIUM_SIZE_MAX
+
 SODIUM_EXPORT
 int crypto_stream_salsa20(unsigned char *c, unsigned long long clen,
                           const unsigned char *n, const unsigned char *k);
diff --git a/src/libsodium/include/sodium/crypto_stream_salsa2012.h b/src/libsodium/include/sodium/crypto_stream_salsa2012.h
index d5c44282..9a2fc2e4 100644
--- a/src/libsodium/include/sodium/crypto_stream_salsa2012.h
+++ b/src/libsodium/include/sodium/crypto_stream_salsa2012.h
@@ -27,6 +27,8 @@ size_t crypto_stream_salsa2012_keybytes(void);
 SODIUM_EXPORT
 size_t crypto_stream_salsa2012_noncebytes(void);
 
+#define crypto_stream_salsa2012_BYTES_MAX SODIUM_SIZE_MAX
+
 SODIUM_EXPORT
 int crypto_stream_salsa2012(unsigned char *c, unsigned long long clen,
                             const unsigned char *n, const unsigned char *k);
diff --git a/src/libsodium/include/sodium/crypto_stream_salsa208.h b/src/libsodium/include/sodium/crypto_stream_salsa208.h
index 02b4166e..81b58d6f 100644
--- a/src/libsodium/include/sodium/crypto_stream_salsa208.h
+++ b/src/libsodium/include/sodium/crypto_stream_salsa208.h
@@ -27,6 +27,8 @@ size_t crypto_stream_salsa208_keybytes(void);
 SODIUM_EXPORT
 size_t crypto_stream_salsa208_noncebytes(void);
 
+#define crypto_stream_salsa208_BYTES_MAX SODIUM_SIZE_MAX
+
 SODIUM_EXPORT
 int crypto_stream_salsa208(unsigned char *c, unsigned long long clen,
                            const unsigned char *n, const unsigned char *k);
diff --git a/src/libsodium/include/sodium/crypto_stream_xchacha20.h b/src/libsodium/include/sodium/crypto_stream_xchacha20.h
index f884798e..a37d4943 100644
--- a/src/libsodium/include/sodium/crypto_stream_xchacha20.h
+++ b/src/libsodium/include/sodium/crypto_stream_xchacha20.h
@@ -28,6 +28,8 @@ size_t crypto_stream_xchacha20_keybytes(void);
 SODIUM_EXPORT
 size_t crypto_stream_xchacha20_noncebytes(void);
 
+#define crypto_stream_xchacha20_BYTES_MAX SODIUM_SIZE_MAX
+
 SODIUM_EXPORT
 int crypto_stream_xchacha20(unsigned char *c, unsigned long long clen,
                             const unsigned char *n, const unsigned char *k);
diff --git a/src/libsodium/include/sodium/crypto_stream_xsalsa20.h b/src/libsodium/include/sodium/crypto_stream_xsalsa20.h
index ed5ae3c3..196e6c96 100644
--- a/src/libsodium/include/sodium/crypto_stream_xsalsa20.h
+++ b/src/libsodium/include/sodium/crypto_stream_xsalsa20.h
@@ -28,6 +28,8 @@ size_t crypto_stream_xsalsa20_keybytes(void);
 SODIUM_EXPORT
 size_t crypto_stream_xsalsa20_noncebytes(void);
 
+#define crypto_stream_xsalsa20_BYTES_MAX SODIUM_SIZE_MAX
+
 SODIUM_EXPORT
 int crypto_stream_xsalsa20(unsigned char *c, unsigned long long clen,
                            const unsigned char *n, const unsigned char *k);
diff --git a/src/libsodium/include/sodium/export.h b/src/libsodium/include/sodium/export.h
index c33bced8..bee18a78 100644
--- a/src/libsodium/include/sodium/export.h
+++ b/src/libsodium/include/sodium/export.h
@@ -41,4 +41,7 @@
 # endif
 #endif
 
+#define SODIUM_MIN(A, B) ((A) < (B) ? (A) : (B))
+#define SODIUM_SIZE_MAX SODIUM_MIN(UINT64_MAX, SIZE_MAX)
+
 #endif
diff --git a/src/libsodium/include/sodium/randombytes.h b/src/libsodium/include/sodium/randombytes.h
index d112fb29..d19f684e 100644
--- a/src/libsodium/include/sodium/randombytes.h
+++ b/src/libsodium/include/sodium/randombytes.h
@@ -25,6 +25,8 @@ typedef struct randombytes_implementation {
     int         (*close)(void);               /* optional */
 } randombytes_implementation;
 
+#define randombytes_BYTES_MAX SODIUM_MIN(SODIUM_SIZE_MAX, 0xffffffffUL)
+
 #define randombytes_SEEDBYTES 32U
 SODIUM_EXPORT
 size_t randombytes_seedbytes(void);
diff --git a/src/libsodium/randombytes/randombytes.c b/src/libsodium/randombytes/randombytes.c
index abcffb88..54888223 100644
--- a/src/libsodium/randombytes/randombytes.c
+++ b/src/libsodium/randombytes/randombytes.c
@@ -174,6 +174,7 @@ randombytes_buf_deterministic(void * const buf, const size_t size,
 
     COMPILER_ASSERT(randombytes_SEEDBYTES == crypto_stream_chacha20_ietf_KEYBYTES);
 #if SIZE_MAX > 0x4000000000ULL
+    COMPILER_ASSERT(randombytes_BYTES_MAX <= 0x4000000000ULL);
     if (size > 0x4000000000ULL) {
         sodium_misuse();
     }
diff --git a/src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c b/src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c
index 36009254..def65f2e 100644
--- a/src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c
+++ b/src/libsodium/randombytes/sysrandom/randombytes_sysrandom.c
@@ -334,7 +334,8 @@ randombytes_sysrandom_buf(void * const buf, const size_t size)
         sodium_misuse(); /* LCOV_EXCL_LINE */
     }
 #else
-    if (size > (size_t) 0xffffffff) {
+    COMPILER_ASSERT(randombytes_BYTES_MAX <= 0xffffffffUL);
+    if (size > (size_t) 0xffffffffUL) {
         sodium_misuse(); /* LCOV_EXCL_LINE */
     }
     if (! RtlGenRandom((PVOID) buf, (ULONG) size)) {