additional sanity check on input arguments

tests/api/test_evp.c

@@ -385,6 +385,18 @@ int test_wolfSSL_EVP_DecodeUpdate(void)
     );
     ExpectIntEQ( outl, 0);
 
+    /* pass negative length */
+    ExpectIntEQ(
+        EVP_DecodeUpdate(
+            ctx,
+            decOutBuff,
+            &outl,
+            enc1,
+            -1),             /* negative inl */
+        -1                    /* expected result code -1: fail */
+    );
+    ExpectIntEQ( outl, 0);
+
     ExpectIntEQ(EVP_DecodeBlock(NULL, NULL, 0), -1);
 
     /* pass zero length input */

wolfcrypt/src/evp.c

@@ -13457,7 +13457,7 @@ int  wolfSSL_EVP_DecodeUpdate(WOLFSSL_EVP_ENCODE_CTX* ctx,
     if (outl == NULL)
         return -1;
 
-    if (ctx == NULL || out == NULL || in == NULL) {
+    if (ctx == NULL || out == NULL || in == NULL || inl < 0) {
         *outl = 0;
         return -1;
     }