diff --git a/ctaocrypt/src/aes.c b/ctaocrypt/src/aes.c
index 96d1dcc99..84a82f6cf 100644
--- a/ctaocrypt/src/aes.c
+++ b/ctaocrypt/src/aes.c
@@ -73,7 +73,7 @@
         return AesSetIV(aes, iv);
     }
 
-    void AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+    int AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     {
         word32 *enc_key, *iv;
         CRYP_InitTypeDef AES_CRYP_InitStructure;
@@ -174,9 +174,11 @@
 
         /* disable crypto processor */
         CRYP_Cmd(DISABLE);
+
+        return 0;
     }
 
-    void AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+    int AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     {
         word32 *dec_key, *iv;
         CRYP_InitTypeDef AES_CRYP_InitStructure;
@@ -293,6 +295,8 @@
 
         /* disable crypto processor */
         CRYP_Cmd(DISABLE);
+
+        return 0;
     }
 
     #ifdef CYASSL_AES_COUNTER
@@ -1678,7 +1682,7 @@ static void AesDecrypt(Aes* aes, const byte* inBlock, byte* outBlock)
 }
 
 
-void AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+int AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
 {
     word32 blocks = sz / AES_BLOCK_SIZE;
 
@@ -1698,11 +1702,33 @@ void AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
             printf("aes->rounds = %d\n", aes->rounds);
             printf("sz = %d\n", sz);
         #endif
+
+        /* check alignment, decrypt doesn't need alignment */
+        if ((word)in % 16) {
+        #ifndef NO_CYASSL_ALLOC_ALIGN
+            byte* tmp = (byte*)XMALLOC(sz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            if (tmp == NULL) return MEMORY_E;
+
+            XMEMCPY(tmp, in, sz);
+            AES_CBC_encrypt(tmp, tmp, (byte*)aes->reg, sz, (byte*)aes->key,
+                        aes->rounds);
+            /* store iv for next call */
+            XMEMCPY(aes->reg, tmp + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE);
+
+            XMEMCPY(out, tmp, sz);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            return 0;
+        #else
+            return BAD_ALIGN_E;
+        #endif
+        }
+
         AES_CBC_encrypt(in, out, (byte*)aes->reg, sz, (byte*)aes->key,
                         aes->rounds);
         /* store iv for next call */
         XMEMCPY(aes->reg, out + sz - AES_BLOCK_SIZE, AES_BLOCK_SIZE);
-        return;
+
+        return 0;
     }
 #endif
 
@@ -1714,10 +1740,12 @@ void AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
         out += AES_BLOCK_SIZE;
         in  += AES_BLOCK_SIZE; 
     }
+
+    return 0;
 }
 
 
-void AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+int AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
 {
     word32 blocks = sz / AES_BLOCK_SIZE;
 
@@ -1744,7 +1772,7 @@ void AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
                         aes->rounds);
         /* store iv for next call */
         XMEMCPY(aes->reg, aes->tmp, AES_BLOCK_SIZE);
-        return;
+        return 0;
     }
 #endif
 
@@ -1757,6 +1785,8 @@ void AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
         out += AES_BLOCK_SIZE;
         in  += AES_BLOCK_SIZE; 
     }
+
+    return 0;
 }
 
 
diff --git a/ctaocrypt/src/error.c b/ctaocrypt/src/error.c
index b1041659e..1df102213 100644
--- a/ctaocrypt/src/error.c
+++ b/ctaocrypt/src/error.c
@@ -297,6 +297,10 @@ void CTaoCryptErrorString(int error, char* buffer)
         XSTRNCPY(buffer, "DeCompress error", max);
         break;
 
+    case BAD_ALIGN_E:
+        XSTRNCPY(buffer, "Bad alignment error, no alloc help", max);
+        break;
+
     default:
         XSTRNCPY(buffer, "unknown error number", max);
 
diff --git a/ctaocrypt/src/hc128.c b/ctaocrypt/src/hc128.c
index 8c3b34369..cb13f7082 100644
--- a/ctaocrypt/src/hc128.c
+++ b/ctaocrypt/src/hc128.c
@@ -26,6 +26,8 @@
 #ifdef HAVE_HC128
 
 #include <cyassl/ctaocrypt/hc128.h>
+#include <cyassl/ctaocrypt/error.h>
+#include <cyassl/ctaocrypt/logging.h>
 #ifdef NO_INLINE
     #include <cyassl/ctaocrypt/hc128.h>
 #else
@@ -259,7 +261,7 @@ static void Hc128_SetIV(HC128* ctx, const byte* iv)
 }
 
 
-void Hc128_SetKey(HC128* ctx, const byte* key, const byte* iv)
+static INLINE int DoKey(HC128* ctx, const byte* key, const byte* iv)
 { 
   word32 i;  
 
@@ -270,11 +272,36 @@ void Hc128_SetKey(HC128* ctx, const byte* key, const byte* iv)
   for ( ; i < 8 ; i++) ctx->key[i] = ctx->key[i-4];
 
   Hc128_SetIV(ctx, iv);
+
+  return 0;
 }
 
 
+/* Key setup */
+int Hc128_SetKey(HC128* ctx, const byte* key, const byte* iv)
+{
+#ifdef XSTREAM_ALIGN
+    if ((word)key % 4 || (word)iv % 4) {
+        int alignKey[4];
+        int alignIv[4];
+
+        CYASSL_MSG("Hc128SetKey unaligned key/iv");
+
+        XMEMCPY(alignKey, key, sizeof(alignKey));
+        XMEMCPY(alignIv,  iv,  sizeof(alignIv));
+
+        return DoKey(ctx, (const byte*)alignKey, (const byte*)alignIv);
+    }
+#endif /* XSTREAM_ALIGN */
+
+    return DoKey(ctx, key, iv);
+}
+
+
+
 /* The following defines the encryption of data stream */
-void Hc128_Process(HC128* ctx, byte* output, const byte* input, word32 msglen)
+static INLINE int DoProcess(HC128* ctx, byte* output, const byte* input,
+                            word32 msglen)
 {
   word32 i, keystream[16];
 
@@ -318,6 +345,36 @@ void Hc128_Process(HC128* ctx, byte* output, const byte* input, word32 msglen)
 	      output[i] = input[i] ^ ((byte*)keystream)[i];
   }
 
+  return 0;
+}
+
+
+/* Encrypt/decrypt a message of any size */
+int Hc128_Process(HC128* ctx, byte* output, const byte* input, word32 msglen)
+{
+#ifdef XSTREAM_ALIGN
+    if ((word)input % 4 || (word)output % 4) {
+        #ifndef NO_CYASSL_ALLOC_ALIGN
+            byte* tmp;
+            CYASSL_MSG("Hc128Process unaligned");
+
+            tmp = (byte*)XMALLOC(msglen, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            if (tmp == NULL) return MEMORY_E;
+
+            XMEMCPY(tmp, input, msglen);
+            DoProcess(ctx, tmp, tmp, msglen);
+            XMEMCPY(output, tmp, msglen);
+
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+
+            return 0;
+        #else
+            return BAD_ALIGN_E;
+        #endif
+    }
+#endif /* XSTREAM_ALIGN */
+
+    return DoProcess(ctx, output, input, msglen);
 }
 
 
diff --git a/ctaocrypt/src/rabbit.c b/ctaocrypt/src/rabbit.c
index ee1b4d664..e0f265866 100644
--- a/ctaocrypt/src/rabbit.c
+++ b/ctaocrypt/src/rabbit.c
@@ -26,6 +26,8 @@
 #ifndef NO_RABBIT
 
 #include <cyassl/ctaocrypt/rabbit.h>
+#include <cyassl/ctaocrypt/error.h>
+#include <cyassl/ctaocrypt/logging.h>
 #ifdef NO_INLINE
     #include <cyassl/ctaocrypt/misc.h>
 #else
@@ -133,7 +135,7 @@ static void RabbitSetIV(Rabbit* ctx, const byte* iv)
 
 
 /* Key setup */
-void RabbitSetKey(Rabbit* ctx, const byte* key, const byte* iv)
+static INLINE int DoKey(Rabbit* ctx, const byte* key, const byte* iv)
 {
     /* Temporary variables */
     word32 k0, k1, k2, k3, i;
@@ -182,14 +184,40 @@ void RabbitSetKey(Rabbit* ctx, const byte* key, const byte* iv)
     }
     ctx->workCtx.carry = ctx->masterCtx.carry;
 
-    if (iv) RabbitSetIV(ctx, iv);    
+    if (iv) RabbitSetIV(ctx, iv);
+
+    return 0;
+}
+
+
+/* Key setup */
+int RabbitSetKey(Rabbit* ctx, const byte* key, const byte* iv)
+{
+#ifdef XSTREAM_ALIGN
+    if ((word)key % 4 || (iv && (word)iv % 4)) {
+        int alignKey[4];
+        int alignIv[2];
+
+        CYASSL_MSG("RabbitSetKey unaligned key/iv");
+
+        XMEMCPY(alignKey, key, sizeof(alignKey));
+        if (iv) {
+            XMEMCPY(alignIv,  iv,  sizeof(alignIv));
+            iv = (const byte*)alignIv;
+        }
+
+        return DoKey(ctx, (const byte*)alignKey, iv);
+    }
+#endif /* XSTREAM_ALIGN */
+
+    return DoKey(ctx, key, iv);
 }
 
 
 /* Encrypt/decrypt a message of any size */
-void RabbitProcess(Rabbit* ctx, byte* output, const byte* input, word32 msglen)
+static INLINE int DoProcess(Rabbit* ctx, byte* output, const byte* input,
+                            word32 msglen)
 {
-
     /* Encrypt/decrypt all full blocks */
     while (msglen >= 16) {
         /* Iterate the system */
@@ -239,8 +267,38 @@ void RabbitProcess(Rabbit* ctx, byte* output, const byte* input, word32 msglen)
             output[i] = input[i] ^ buffer[i];  /* scan-build thinks buffer[i] */
                                                /* is garbage, it is not! */ 
     }
+
+    return 0;
 }
 
 
+/* Encrypt/decrypt a message of any size */
+int RabbitProcess(Rabbit* ctx, byte* output, const byte* input, word32 msglen)
+{
+#ifdef XSTREAM_ALIGN
+    if ((word)input % 4 || (word)output % 4) {
+        #ifndef NO_CYASSL_ALLOC_ALIGN
+            byte* tmp;
+            CYASSL_MSG("RabbitProcess unaligned");
+
+            tmp = (byte*)XMALLOC(msglen, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            if (tmp == NULL) return MEMORY_E;
+
+            XMEMCPY(tmp, input, msglen);
+            DoProcess(ctx, tmp, tmp, msglen);
+            XMEMCPY(output, tmp, msglen);
+
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+
+            return 0;
+        #else
+            return BAD_ALIGN_E;
+        #endif
+    }
+#endif /* XSTREAM_ALIGN */
+
+    return DoProcess(ctx, output, input, msglen);
+}
+
 
 #endif /* NO_RABBIT */
diff --git a/cyassl/ctaocrypt/aes.h b/cyassl/ctaocrypt/aes.h
index 18b7a035c..97f9cfd83 100644
--- a/cyassl/ctaocrypt/aes.h
+++ b/cyassl/ctaocrypt/aes.h
@@ -98,8 +98,8 @@ typedef struct Aes {
 CYASSL_API int  AesSetKey(Aes* aes, const byte* key, word32 len, const byte* iv,
                           int dir);
 CYASSL_API int  AesSetIV(Aes* aes, const byte* iv);
-CYASSL_API void AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz);
-CYASSL_API void AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz);
+CYASSL_API int  AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz);
+CYASSL_API int  AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz);
 CYASSL_API void AesCtrEncrypt(Aes* aes, byte* out, const byte* in, word32 sz);
 CYASSL_API void AesEncryptDirect(Aes* aes, byte* out, const byte* in);
 CYASSL_API void AesDecryptDirect(Aes* aes, byte* out, const byte* in);
diff --git a/cyassl/ctaocrypt/error.h b/cyassl/ctaocrypt/error.h
index 265019822..14a08af95 100644
--- a/cyassl/ctaocrypt/error.h
+++ b/cyassl/ctaocrypt/error.h
@@ -108,6 +108,8 @@ enum {
     DECOMPRESS_INIT_E  = -185,  /* DeCompress init error */
     DECOMPRESS_E       = -186,  /* DeCompress error */
 
+    BAD_ALIGN_E        = -187,  /* Bad alignment for operation, no alloc */
+
     MIN_CODE_E         = -200   /* errors -101 - -199 */
 };
 
diff --git a/cyassl/ctaocrypt/hc128.h b/cyassl/ctaocrypt/hc128.h
index c395b0483..cdd70291a 100644
--- a/cyassl/ctaocrypt/hc128.h
+++ b/cyassl/ctaocrypt/hc128.h
@@ -47,8 +47,8 @@ typedef struct HC128 {
 } HC128;
 
 
-CYASSL_API void Hc128_Process(HC128*, byte*, const byte*, word32);
-CYASSL_API void Hc128_SetKey(HC128*, const byte* key, const byte* iv);
+CYASSL_API int Hc128_Process(HC128*, byte*, const byte*, word32);
+CYASSL_API int Hc128_SetKey(HC128*, const byte* key, const byte* iv);
 
 
 #ifdef __cplusplus
diff --git a/cyassl/ctaocrypt/rabbit.h b/cyassl/ctaocrypt/rabbit.h
index 93f9c7a95..97bca779b 100644
--- a/cyassl/ctaocrypt/rabbit.h
+++ b/cyassl/ctaocrypt/rabbit.h
@@ -52,8 +52,8 @@ typedef struct Rabbit {
 } Rabbit;
 
 
-CYASSL_API void RabbitProcess(Rabbit*, byte*, const byte*, word32);
-CYASSL_API void RabbitSetKey(Rabbit*, const byte* key, const byte* iv);
+CYASSL_API int RabbitProcess(Rabbit*, byte*, const byte*, word32);
+CYASSL_API int RabbitSetKey(Rabbit*, const byte* key, const byte* iv);
 
 
 #ifdef __cplusplus
diff --git a/mcapi/crypto.c b/mcapi/crypto.c
index 32aa43adf..e3508884f 100644
--- a/mcapi/crypto.c
+++ b/mcapi/crypto.c
@@ -435,9 +435,7 @@ int CRYPT_AES_CBC_Encrypt(CRYPT_AES_CTX* aes, unsigned char* out,
     if (aes == NULL || out == NULL || in == NULL)
         return BAD_FUNC_ARG;
 
-    AesCbcEncrypt((Aes*)aes, out, in, inSz);
-
-    return 0;
+    return AesCbcEncrypt((Aes*)aes, out, in, inSz);
 }
 
 
@@ -448,9 +446,7 @@ int CRYPT_AES_CBC_Decrypt(CRYPT_AES_CTX* aes, unsigned char* out,
     if (aes == NULL || out == NULL || in == NULL)
         return BAD_FUNC_ARG;
 
-    AesCbcDecrypt((Aes*)aes, out, in, inSz);
-
-    return 0;
+    return AesCbcDecrypt((Aes*)aes, out, in, inSz);
 }
 
 
diff --git a/src/internal.c b/src/internal.c
index acc2dafd2..7bb002842 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -3424,19 +3424,7 @@ static INLINE int Encrypt(CYASSL* ssl, byte* out, const byte* input, word32 sz)
 
         #ifdef BUILD_AES
             case aes:
-            #ifdef CYASSL_AESNI
-                if ((word)input % 16) {
-                    byte* tmp = (byte*)XMALLOC(sz, ssl->heap,
-                                               DYNAMIC_TYPE_TMP_BUFFER);
-                    if (tmp == NULL) return MEMORY_E;
-                    XMEMCPY(tmp, input, sz);
-                    AesCbcEncrypt(ssl->encrypt.aes, tmp, tmp, sz);
-                    XMEMCPY(out, tmp, sz);
-                    XFREE(tmp, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
-                    break;
-                }
-            #endif
-                AesCbcEncrypt(ssl->encrypt.aes, out, input, sz);
+                return AesCbcEncrypt(ssl->encrypt.aes, out, input, sz);
                 break;
         #endif
 
@@ -3532,37 +3520,13 @@ static INLINE int Encrypt(CYASSL* ssl, byte* out, const byte* input, word32 sz)
 
         #ifdef HAVE_HC128
             case hc128:
-                #ifdef XSTREAM_ALIGNMENT
-                if ((word)input % 4) {
-                    byte* tmp = (byte*)XMALLOC(sz, ssl->heap,
-                                               DYNAMIC_TYPE_TMP_BUFFER);
-                    if (tmp == NULL) return MEMORY_E;
-                    XMEMCPY(tmp, input, sz);
-                    Hc128_Process(ssl->encrypt.hc128, tmp, tmp, sz);
-                    XMEMCPY(out, tmp, sz);
-                    XFREE(tmp, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
-                    break;
-                }
-                #endif
-                Hc128_Process(ssl->encrypt.hc128, out, input, sz);
+                return Hc128_Process(ssl->encrypt.hc128, out, input, sz);
                 break;
         #endif
 
         #ifdef BUILD_RABBIT
             case rabbit:
-                #ifdef XSTREAM_ALIGNMENT
-                if ((word)input % 4) {
-                    byte* tmp = (byte*)XMALLOC(sz, ssl->heap,
-                                               DYNAMIC_TYPE_TMP_BUFFER);
-                    if (tmp == NULL) return MEMORY_E;
-                    XMEMCPY(tmp, input, sz);
-                    RabbitProcess(ssl->encrypt.rabbit, tmp, tmp, sz);
-                    XMEMCPY(out, tmp, sz);
-                    XFREE(tmp, ssl->heap, DYNAMIC_TYPE_TMP_BUFFER);
-                    break;
-                }
-                #endif
-                RabbitProcess(ssl->encrypt.rabbit, out, input, sz);
+                return RabbitProcess(ssl->encrypt.rabbit, out, input, sz);
                 break;
         #endif
 
@@ -3610,7 +3574,7 @@ static INLINE int Decrypt(CYASSL* ssl, byte* plain, const byte* input,
 
         #ifdef BUILD_AES
             case aes:
-                AesCbcDecrypt(ssl->decrypt.aes, plain, input, sz);
+                return AesCbcDecrypt(ssl->decrypt.aes, plain, input, sz);
                 break;
         #endif
 
@@ -3694,13 +3658,13 @@ static INLINE int Decrypt(CYASSL* ssl, byte* plain, const byte* input,
 
         #ifdef HAVE_HC128
             case hc128:
-                Hc128_Process(ssl->decrypt.hc128, plain, input, sz);
+                return Hc128_Process(ssl->decrypt.hc128, plain, input, sz);
                 break;
         #endif
 
         #ifdef BUILD_RABBIT
             case rabbit:
-                RabbitProcess(ssl->decrypt.rabbit, plain, input, sz);
+                return RabbitProcess(ssl->decrypt.rabbit, plain, input, sz);
                 break;
         #endif
 
diff --git a/src/keys.c b/src/keys.c
index 14ebb0d93..4e9fcd81c 100644
--- a/src/keys.c
+++ b/src/keys.c
@@ -1452,6 +1452,7 @@ static int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, CipherSpecs* specs,
     
 #ifdef HAVE_HC128
     if (specs->bulk_cipher_algorithm == hc128) {
+        int hcRet;
         enc->hc128 = (HC128*)XMALLOC(sizeof(HC128), heap, DYNAMIC_TYPE_CIPHER);
         if (enc->hc128 == NULL)
             return MEMORY_E;
@@ -1459,16 +1460,20 @@ static int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, CipherSpecs* specs,
         if (dec->hc128 == NULL)
             return MEMORY_E;
         if (side == CLIENT_END) {
-            Hc128_SetKey(enc->hc128, keys->client_write_key,
-                                          keys->client_write_IV);
-            Hc128_SetKey(dec->hc128, keys->server_write_key,
-                                          keys->server_write_IV);
+            hcRet = Hc128_SetKey(enc->hc128, keys->client_write_key,
+                                 keys->client_write_IV);
+            if (hcRet != 0) return hcRet;
+            hcRet = Hc128_SetKey(dec->hc128, keys->server_write_key,
+                                  keys->server_write_IV);
+            if (hcRet != 0) return hcRet;
         }
         else {
-            Hc128_SetKey(enc->hc128, keys->server_write_key,
-                                         keys->server_write_IV);
-            Hc128_SetKey(dec->hc128, keys->client_write_key,
-                                         keys->client_write_IV);
+            hcRet = Hc128_SetKey(enc->hc128, keys->server_write_key,
+                                  keys->server_write_IV);
+            if (hcRet != 0) return hcRet;
+            hcRet = Hc128_SetKey(dec->hc128, keys->client_write_key,
+                                  keys->client_write_IV);
+            if (hcRet != 0) return hcRet;
         }
         enc->setup = 1;
         dec->setup = 1;
@@ -1477,6 +1482,7 @@ static int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, CipherSpecs* specs,
     
 #ifdef BUILD_RABBIT
     if (specs->bulk_cipher_algorithm == rabbit) {
+        int rabRet;
         enc->rabbit = (Rabbit*)XMALLOC(sizeof(Rabbit),heap,DYNAMIC_TYPE_CIPHER);
         if (enc->rabbit == NULL)
             return MEMORY_E;
@@ -1484,16 +1490,20 @@ static int SetKeys(Ciphers* enc, Ciphers* dec, Keys* keys, CipherSpecs* specs,
         if (dec->rabbit == NULL)
             return MEMORY_E;
         if (side == CLIENT_END) {
-            RabbitSetKey(enc->rabbit, keys->client_write_key,
-                                           keys->client_write_IV);
-            RabbitSetKey(dec->rabbit, keys->server_write_key,
-                                           keys->server_write_IV);
+            rabRet = RabbitSetKey(enc->rabbit, keys->client_write_key,
+                                  keys->client_write_IV);
+            if (rabRet != 0) return rabRet;
+            rabRet = RabbitSetKey(dec->rabbit, keys->server_write_key,
+                                  keys->server_write_IV);
+            if (rabRet != 0) return rabRet;
         }
         else {
-            RabbitSetKey(enc->rabbit, keys->server_write_key,
+            rabRet = RabbitSetKey(enc->rabbit, keys->server_write_key,
                                            keys->server_write_IV);
-            RabbitSetKey(dec->rabbit, keys->client_write_key,
+            if (rabRet != 0) return rabRet;
+            rabRet = RabbitSetKey(dec->rabbit, keys->client_write_key,
                                            keys->client_write_IV);
+            if (rabRet != 0) return rabRet;
         }
         enc->setup = 1;
         dec->setup = 1;
diff --git a/src/ssl.c b/src/ssl.c
index ade477e90..d336e44d7 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -4997,6 +4997,7 @@ int CyaSSL_set_compression(CYASSL* ssl)
     int CyaSSL_EVP_Cipher(CYASSL_EVP_CIPHER_CTX* ctx, byte* dst, byte* src,
                           word32 len)
     {
+        int ret = 0;
         CYASSL_ENTER("CyaSSL_EVP_Cipher");
 
         if (ctx == NULL || dst == NULL || src == NULL) {
@@ -5016,9 +5017,9 @@ int CyaSSL_set_compression(CYASSL* ssl)
             case AES_256_CBC_TYPE :
                 CYASSL_MSG("AES CBC");
                 if (ctx->enc)
-                    AesCbcEncrypt(&ctx->cipher.aes, dst, src, len);
+                    ret = AesCbcEncrypt(&ctx->cipher.aes, dst, src, len);
                 else
-                    AesCbcDecrypt(&ctx->cipher.aes, dst, src, len);
+                    ret = AesCbcDecrypt(&ctx->cipher.aes, dst, src, len);
                 break;
 
 #ifdef CYASSL_AES_COUNTER
@@ -5056,7 +5057,12 @@ int CyaSSL_set_compression(CYASSL* ssl)
                 CYASSL_MSG("bad type");
                 return 0;  /* failure */
             }
-        }    
+        }
+
+        if (ret != 0) {
+            CYASSL_MSG("CyaSSL_EVP_Cipher failure");
+            return 0;  /* failuer */ 
+        }
 
         CYASSL_MSG("CyaSSL_EVP_Cipher success");
         return 1;  /* success */