From 7d7299e25499c8d2de171123060f3bca5c03f192 Mon Sep 17 00:00:00 2001
From: Anthony Hu <anthony@wolfssl.com>
Date: Wed, 21 Jan 2026 17:49:30 -0500
Subject: [PATCH] Do not allow NULL with non-zero length.

---
 wolfcrypt/src/chacha20_poly1305.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/wolfcrypt/src/chacha20_poly1305.c b/wolfcrypt/src/chacha20_poly1305.c
index 75f522e87..cadf7ff5b 100644
--- a/wolfcrypt/src/chacha20_poly1305.c
+++ b/wolfcrypt/src/chacha20_poly1305.c
@@ -313,7 +313,8 @@ int wc_XChaCha20Poly1305_Init(
     byte authKey[CHACHA20_POLY1305_AEAD_KEYSIZE];
     int ret;
 
-    if ((aead == NULL) || (nonce == NULL) || (key == NULL))
+    if ((aead == NULL) || (ad == NULL && ad_len > 0) || (nonce == NULL) ||
+        (key == NULL))
         return BAD_FUNC_ARG;
 
     if ((key_len != CHACHA20_POLY1305_AEAD_KEYSIZE) ||