diff --git a/crypto/cryptoapi/cryptoapi.c b/crypto/cryptoapi/cryptoapi.c
--- a/crypto/cryptoapi/cryptoapi.c
+++ b/crypto/cryptoapi/cryptoapi.c
@@ -1138,6 +1138,8 @@
 
 	if ((datalen % session->cipher->blocksize) != 0)
 		return (EINVAL);
+	if (ivlen < 0 || ivlen > (int)sizeof(iv2))
+		return (EINVAL);
 
 	memset(iv2, 0, sizeof(iv2));
 	memcpy(iv2, iv, ivlen);