@zigc/lib 0.17.0-dev.27 → 0.17.0-dev.296

package/std/crypto/pbkdf2.zig

@@ -206,7 +206,7 @@ test "RFC 6070 16,777,216 iterations" {
     const c = 16777216;
     const dk_len = 20;
 
-    var dk = [_]u8{0} ** dk_len;
+    var dk: [dk_len]u8 = @splat(0);
 
     try pbkdf2(&dk, p, s, c, HmacSha1);
 

package/std/crypto/pcurves/common.zig

@@ -2,7 +2,6 @@ const std = @import("std");
 const crypto = std.crypto;
 const debug = std.debug;
 const mem = std.mem;
-const meta = std.meta;
 
 const NonCanonicalError = crypto.errors.NonCanonicalError;
 const NotSquareError = crypto.errors.NotSquareError;
@@ -54,7 +53,7 @@ pub fn Field(comptime params: FieldParams) type {
             var s = if (endian == .little) s_ else orderSwap(s_);
             const field_order_s = comptime fos: {
                 var fos: [encoded_length]u8 = undefined;
-                mem.writeInt(std.meta.Int(.unsigned, encoded_length * 8), &fos, field_order, .little);
+                mem.writeInt(@Int(.unsigned, encoded_length * 8), &fos, field_order, .little);
                 break :fos fos;
             };
             if (crypto.timing_safe.compare(u8, &s, &field_order_s, .little) != .lt) {
@@ -90,7 +89,7 @@ pub fn Field(comptime params: FieldParams) type {
         }
 
         /// Element as an integer.
-        pub const IntRepr = meta.Int(.unsigned, params.field_bits);
+        pub const IntRepr = @Int(.unsigned, params.field_bits);
 
         /// Create a field element from an integer.
         pub fn fromInt(comptime x: IntRepr) NonCanonicalError!Fe {
@@ -270,7 +269,7 @@ pub fn Field(comptime params: FieldParams) type {
                 const ls = x126.sqn(126).mul(x126).sqn(3).mul(t111).sqn(33).mul(x32).sqn(95).mul(x31);
                 return ls.equivalent(Fe.one);
             } else {
-                const ls = x2.pow(std.meta.Int(.unsigned, field_bits), (field_order - 1) / 2); // Legendre symbol
+                const ls = x2.pow(@Int(.unsigned, field_bits), (field_order - 1) / 2); // Legendre symbol
                 return ls.equivalent(Fe.one);
             }
         }
@@ -307,7 +306,7 @@ pub fn Field(comptime params: FieldParams) type {
                 const x108 = x54.sqn(54).mul(x54);
                 return x108.sqn(108).mul(x108).sqn(7).mul(t1111111).sqn(23).mul(x22).sqn(6).mul(t11).sqn(2);
             } else {
-                return x2.pow(std.meta.Int(.unsigned, field_bits), (field_order + 1) / 4);
+                return x2.pow(@Int(.unsigned, field_bits), (field_order + 1) / 4);
             }
         }
 

package/std/crypto/pcurves/p256/scalar.zig

@@ -196,19 +196,19 @@ const ScalarDouble = struct {
         }
         var t = ScalarDouble{ .x1 = undefined, .x2 = Fe.zero, .x3 = Fe.zero };
         {
-            var b = [_]u8{0} ** encoded_length;
+            var b: [encoded_length]u8 = @splat(0);
             const len = @min(s.len, 24);
             b[0..len].* = s[0..len].*;
             t.x1 = Fe.fromBytes(b, .little) catch unreachable;
         }
         if (s_.len >= 24) {
-            var b = [_]u8{0} ** encoded_length;
+            var b: [encoded_length]u8 = @splat(0);
             const len = @min(s.len - 24, 24);
             b[0..len].* = s[24..][0..len].*;
             t.x2 = Fe.fromBytes(b, .little) catch unreachable;
         }
         if (s_.len >= 48) {
-            var b = [_]u8{0} ** encoded_length;
+            var b: [encoded_length]u8 = @splat(0);
             const len = s.len - 48;
             b[0..len].* = s[48..][0..len].*;
             t.x3 = Fe.fromBytes(b, .little) catch unreachable;

package/std/crypto/pcurves/p384/scalar.zig

@@ -184,13 +184,13 @@ const ScalarDouble = struct {
         }
         var t = ScalarDouble{ .x1 = undefined, .x2 = Fe.zero };
         {
-            var b = [_]u8{0} ** encoded_length;
+            var b: [encoded_length]u8 = @splat(0);
             const len = @min(s.len, 32);
             b[0..len].* = s[0..len].*;
             t.x1 = Fe.fromBytes(b, .little) catch unreachable;
         }
         if (s_.len >= 32) {
-            var b = [_]u8{0} ** encoded_length;
+            var b: [encoded_length]u8 = @splat(0);
             const len = @min(s.len - 32, 32);
             b[0..len].* = s[32..][0..len].*;
             t.x2 = Fe.fromBytes(b, .little) catch unreachable;

package/std/crypto/pcurves/secp256k1/scalar.zig

@@ -196,19 +196,19 @@ const ScalarDouble = struct {
         }
         var t = ScalarDouble{ .x1 = undefined, .x2 = Fe.zero, .x3 = Fe.zero };
         {
-            var b = [_]u8{0} ** encoded_length;
+            var b: [encoded_length]u8 = @splat(0);
             const len = @min(s.len, 24);
             b[0..len].* = s[0..len].*;
             t.x1 = Fe.fromBytes(b, .little) catch unreachable;
         }
         if (s_.len >= 24) {
-            var b = [_]u8{0} ** encoded_length;
+            var b: [encoded_length]u8 = @splat(0);
             const len = @min(s.len - 24, 24);
             b[0..len].* = s[24..][0..len].*;
             t.x2 = Fe.fromBytes(b, .little) catch unreachable;
         }
         if (s_.len >= 48) {
-            var b = [_]u8{0} ** encoded_length;
+            var b: [encoded_length]u8 = @splat(0);
             const len = s.len - 48;
             b[0..len].* = s[48..][0..len].*;
             t.x3 = Fe.fromBytes(b, .little) catch unreachable;

package/std/crypto/pcurves/tests/p256.zig

@@ -97,7 +97,7 @@ test "p256 public key is the neutral element (public verification)" {
 }
 
 test "p256 field element non-canonical encoding" {
-    const s = [_]u8{0xff} ** 32;
+    const s: [32]u8 = @splat(0xff);
     try testing.expectError(error.NonCanonical, P256.Fe.fromBytes(s, .little));
 }
 
@@ -110,8 +110,8 @@ test "p256 neutral element decoding" {
 test "p256 double base multiplication" {
     const p1 = P256.basePoint;
     const p2 = P256.basePoint.dbl();
-    const s1 = [_]u8{0x01} ** 32;
-    const s2 = [_]u8{0x02} ** 32;
+    const s1: [32]u8 = @splat(0x01);
+    const s2: [32]u8 = @splat(0x02);
     const pr1 = try P256.mulDoubleBasePublic(p1, s1, p2, s2, .little);
     const pr2 = (try p1.mul(s1, .little)).add(try p2.mul(s2, .little));
     try testing.expect(pr1.equivalent(pr2));
@@ -120,8 +120,8 @@ test "p256 double base multiplication" {
 test "p256 double base multiplication with large scalars" {
     const p1 = P256.basePoint;
     const p2 = P256.basePoint.dbl();
-    const s1 = [_]u8{0xee} ** 32;
-    const s2 = [_]u8{0xdd} ** 32;
+    const s1: [32]u8 = @splat(0xee);
+    const s2: [32]u8 = @splat(0xdd);
     const pr1 = try P256.mulDoubleBasePublic(p1, s1, p2, s2, .little);
     const pr2 = (try p1.mul(s1, .little)).add(try p2.mul(s2, .little));
     try testing.expect(pr1.equivalent(pr2));

package/std/crypto/pcurves/tests/p384.zig

@@ -100,7 +100,7 @@ test "p384 public key is the neutral element (public verification)" {
 }
 
 test "p384 field element non-canonical encoding" {
-    const s = [_]u8{0xff} ** 48;
+    const s: [48]u8 = @splat(0xff);
     try testing.expectError(error.NonCanonical, P384.Fe.fromBytes(s, .little));
 }
 
@@ -113,8 +113,8 @@ test "p384 neutral element decoding" {
 test "p384 double base multiplication" {
     const p1 = P384.basePoint;
     const p2 = P384.basePoint.dbl();
-    const s1 = [_]u8{0x01} ** 48;
-    const s2 = [_]u8{0x02} ** 48;
+    const s1: [48]u8 = @splat(0x01);
+    const s2: [48]u8 = @splat(0x02);
     const pr1 = try P384.mulDoubleBasePublic(p1, s1, p2, s2, .little);
     const pr2 = (try p1.mul(s1, .little)).add(try p2.mul(s2, .little));
     try testing.expect(pr1.equivalent(pr2));
@@ -123,8 +123,8 @@ test "p384 double base multiplication" {
 test "p384 double base multiplication with large scalars" {
     const p1 = P384.basePoint;
     const p2 = P384.basePoint.dbl();
-    const s1 = [_]u8{0xee} ** 48;
-    const s2 = [_]u8{0xdd} ** 48;
+    const s1: [48]u8 = @splat(0xee);
+    const s2: [48]u8 = @splat(0xdd);
     const pr1 = try P384.mulDoubleBasePublic(p1, s1, p2, s2, .little);
     const pr2 = (try p1.mul(s1, .little)).add(try p2.mul(s2, .little));
     try testing.expect(pr1.equivalent(pr2));

package/std/crypto/pcurves/tests/secp256k1.zig

@@ -109,7 +109,7 @@ test "secp256k1 public key is the neutral element (public verification)" {
 }
 
 test "secp256k1 field element non-canonical encoding" {
-    const s = [_]u8{0xff} ** 32;
+    const s: [32]u8 = @splat(0xff);
     try testing.expectError(error.NonCanonical, Secp256k1.Fe.fromBytes(s, .little));
 }
 
@@ -122,8 +122,8 @@ test "secp256k1 neutral element decoding" {
 test "secp256k1 double base multiplication" {
     const p1 = Secp256k1.basePoint;
     const p2 = Secp256k1.basePoint.dbl();
-    const s1 = [_]u8{0x01} ** 32;
-    const s2 = [_]u8{0x02} ** 32;
+    const s1: [32]u8 = @splat(0x01);
+    const s2: [32]u8 = @splat(0x02);
     const pr1 = try Secp256k1.mulDoubleBasePublic(p1, s1, p2, s2, .little);
     const pr2 = (try p1.mul(s1, .little)).add(try p2.mul(s2, .little));
     try testing.expect(pr1.equivalent(pr2));

package/std/crypto/salsa20.zig

@@ -384,7 +384,7 @@ pub const XSalsa20Poly1305 = struct {
     pub fn encrypt(c: []u8, tag: *[tag_length]u8, m: []const u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) void {
         debug.assert(c.len == m.len);
         const extended = extend(rounds, k, npub);
-        var block0 = [_]u8{0} ** 64;
+        var block0: [64]u8 = @splat(0);
         const mlen0 = @min(32, m.len);
         @memcpy(block0[32..][0..mlen0], m[0..mlen0]);
         Salsa20.xor(block0[0..], block0[0..], 0, extended.key, extended.nonce);
@@ -408,7 +408,7 @@ pub const XSalsa20Poly1305 = struct {
     pub fn decrypt(m: []u8, c: []const u8, tag: [tag_length]u8, ad: []const u8, npub: [nonce_length]u8, k: [key_length]u8) AuthenticationError!void {
         debug.assert(c.len == m.len);
         const extended = extend(rounds, k, npub);
-        var block0 = [_]u8{0} ** 64;
+        var block0: [64]u8 = @splat(0);
         const mlen0 = @min(32, c.len);
         @memcpy(block0[32..][0..mlen0], c[0..mlen0]);
         Salsa20.xor(block0[0..], block0[0..], 0, extended.key, extended.nonce);
@@ -489,7 +489,7 @@ pub const Box = struct {
     /// Compute a secret suitable for `secretbox` given a recipient's public key and a sender's secret key.
     pub fn createSharedSecret(public_key: [public_length]u8, secret_key: [secret_length]u8) (IdentityElementError || WeakPublicKeyError)![shared_length]u8 {
         const p = try X25519.scalarmult(secret_key, public_key);
-        const zero = [_]u8{0} ** 16;
+        const zero: [16]u8 = @splat(0);
         return SalsaImpl(20).hsalsa(zero, p);
     }
 
@@ -559,15 +559,15 @@ const htest = @import("test.zig");
 test "(x)salsa20" {
     if (builtin.cpu.has(.riscv, .v) and builtin.zig_backend == .stage2_llvm) return error.SkipZigTest; // https://github.com/ziglang/zig/issues/24299
 
-    const key = [_]u8{0x69} ** 32;
-    const nonce = [_]u8{0x42} ** 8;
-    const msg = [_]u8{0} ** 20;
+    const key: [32]u8 = @splat(0x69);
+    const nonce: [8]u8 = @splat(0x42);
+    const msg: [20]u8 = @splat(0);
     var c: [msg.len]u8 = undefined;
 
     Salsa20.xor(&c, msg[0..], 0, key, nonce);
     try htest.assertEqual("30ff9933aa6534ff5207142593cd1fca4b23bdd8", c[0..]);
 
-    const extended_nonce = [_]u8{0x42} ** 24;
+    const extended_nonce: [24]u8 = @splat(0x42);
     XSalsa20.xor(&c, msg[0..], 0, key, extended_nonce);
     try htest.assertEqual("b4ab7d82e750ec07644fa3281bce6cd91d4243f9", c[0..]);
 }
@@ -637,7 +637,7 @@ test "xsalsa20poly1305 sealedbox" {
 test "secretbox twoblocks" {
     const key = [_]u8{ 0xc9, 0xc9, 0x4d, 0xcf, 0x68, 0xbe, 0x00, 0xe4, 0x7f, 0xe6, 0x13, 0x26, 0xfc, 0xc4, 0x2f, 0xd0, 0xdb, 0x93, 0x91, 0x1c, 0x09, 0x94, 0x89, 0xe1, 0x1b, 0x88, 0x63, 0x18, 0x86, 0x64, 0x8b, 0x7b };
     const nonce = [_]u8{ 0xa4, 0x33, 0xe9, 0x0a, 0x07, 0x68, 0x6e, 0x9a, 0x2b, 0x6d, 0xd4, 0x59, 0x04, 0x72, 0x3e, 0xd3, 0x8a, 0x67, 0x55, 0xc7, 0x9e, 0x3e, 0x77, 0xdc };
-    const msg = [_]u8{'a'} ** 97;
+    const msg: [97]u8 = @splat('a');
     var ciphertext: [msg.len + SecretBox.tag_length]u8 = undefined;
     SecretBox.seal(&ciphertext, &msg, nonce, key);
     try htest.assertEqual("b05760e217288ba079caa2fd57fd3701784974ffcfda20fe523b89211ad8af065a6eb37cdb29d51aca5bd75dafdd21d18b044c54bb7c526cf576c94ee8900f911ceab0147e82b667a28c52d58ceb29554ff45471224d37b03256b01c119b89ff6d36855de8138d103386dbc9d971f52261", &ciphertext);

package/std/crypto/sha2.zig

@@ -461,7 +461,7 @@ test "sha256 streaming" {
 }
 
 test "sha256 aligned final" {
-    var block = [_]u8{0} ** Sha256.block_length;
+    var block: [Sha256.block_length]u8 = @splat(0);
     var out: [Sha256.digest_length]u8 = undefined;
 
     var h = Sha256.init(.{});
@@ -833,7 +833,7 @@ test "sha512 streaming" {
 }
 
 test "sha512 aligned final" {
-    var block = [_]u8{0} ** Sha512.block_length;
+    var block: [Sha512.block_length]u8 = @splat(0);
     var out: [Sha512.digest_length]u8 = undefined;
 
     var h = Sha512.init(.{});

package/std/crypto/sha3.zig

@@ -543,7 +543,7 @@ test "sha3-256 streaming" {
 }
 
 test "sha3-256 aligned final" {
-    var block = [_]u8{0} ** Sha3_256.block_length;
+    var block: [Sha3_256.block_length]u8 = @splat(0);
     var out: [Sha3_256.digest_length]u8 = undefined;
 
     var h = Sha3_256.init(.{});
@@ -616,7 +616,7 @@ test "sha3-512 streaming" {
 }
 
 test "sha3-512 aligned final" {
-    var block = [_]u8{0} ** Sha3_512.block_length;
+    var block: [Sha3_512.block_length]u8 = @splat(0);
     var out: [Sha3_512.digest_length]u8 = undefined;
 
     var h = Sha3_512.init(.{});

package/std/crypto/siphash.zig

@@ -91,7 +91,7 @@ fn SipHashStateless(comptime T: type, comptime c_rounds: usize, comptime d_round
 
             self.msg_len +%= @as(u8, @truncate(b.len));
 
-            var buf = [_]u8{0} ** 8;
+            var buf: [8]u8 = @splat(0);
             @memcpy(buf[0..b.len], b);
             buf[7] = self.msg_len;
             self.round(buf);

package/std/crypto/timing_safe.zig

@@ -21,8 +21,8 @@ pub fn eql(comptime T: type, a: T, b: T) bool {
                 acc |= x ^ b[i];
             }
             const s = @typeInfo(C).int.bits;
-            const Cu = std.meta.Int(.unsigned, s);
-            const Cext = std.meta.Int(.unsigned, s + 1);
+            const Cu = @Int(.unsigned, s);
+            const Cext = @Int(.unsigned, s + 1);
             return @as(bool, @bitCast(@as(u1, @truncate((@as(Cext, @as(Cu, @bitCast(acc))) -% 1) >> s))));
         },
         .vector => |info| {
@@ -32,8 +32,8 @@ pub fn eql(comptime T: type, a: T, b: T) bool {
             }
             const acc = @reduce(.Or, a ^ b);
             const s = @typeInfo(C).int.bits;
-            const Cu = std.meta.Int(.unsigned, s);
-            const Cext = std.meta.Int(.unsigned, s + 1);
+            const Cu = @Int(.unsigned, s);
+            const Cext = @Int(.unsigned, s + 1);
             return @as(bool, @bitCast(@as(u1, @truncate((@as(Cext, @as(Cu, @bitCast(acc))) -% 1) >> s))));
         },
         else => {
@@ -50,7 +50,7 @@ pub fn compare(comptime T: type, a: []const T, b: []const T, endian: Endian) Ord
         .int => |cinfo| if (cinfo.signedness != .unsigned) @compileError("Elements to be compared must be unsigned") else cinfo.bits,
         else => @compileError("Elements to be compared must be integers"),
     };
-    const Cext = std.meta.Int(.unsigned, bits + 1);
+    const Cext = @Int(.unsigned, bits + 1);
     var gt: T = 0;
     var eq: T = 1;
     if (endian == .little) {
@@ -207,8 +207,8 @@ test "eql (vectors)" {
 
 test compare {
     const expectEqual = std.testing.expectEqual;
-    var a = [_]u8{10} ** 32;
-    var b = [_]u8{10} ** 32;
+    var a: [32]u8 = @splat(10);
+    var b: [32]u8 = @splat(10);
     try expectEqual(compare(u8, &a, &b, .big), .eq);
     try expectEqual(compare(u8, &a, &b, .little), .eq);
     a[31] = 1;
@@ -228,7 +228,7 @@ test "add and sub" {
     var a: [len]u8 = undefined;
     var b: [len]u8 = undefined;
     var c: [len]u8 = undefined;
-    const zero = [_]u8{0} ** len;
+    const zero: [len]u8 = @splat(0);
     var iterations: usize = 100;
     while (iterations != 0) : (iterations -= 1) {
         io.random(&a);
@@ -262,7 +262,8 @@ test classify {
     declassify(&out);
 
     // Comparing public data in non-constant time is acceptable.
-    try expect(!std.mem.eql(u8, &out, &[_]u8{0} ** out.len));
+    const zeroes: [out.len]u8 = @splat(0);
+    try expect(!std.mem.eql(u8, &out, &zeroes));
 
     // Comparing secret data must be done in constant time. The result
     // is going to be considered as secret as well.

package/std/crypto/tls/Client.zig

@@ -353,7 +353,7 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
         if (record_len > tls.max_ciphertext_len) return error.TlsRecordOverflow;
         const record_buffer = input.take(record_len) catch |err| switch (err) {
             error.EndOfStream => return error.TlsConnectionTruncated,
-            error.ReadFailed => return error.ReadFailed,
+            error.ReadFailed => |e| return e,
         };
         var record_decoder: tls.Decoder = .fromTheirSlice(record_buffer);
         var ctd, const ct = content: switch (cipher_state) {
@@ -375,14 +375,16 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
                         const auth_tag = record_decoder.array(P.AEAD.tag_length).*;
                         const nonce = nonce: {
                             const V = @Vector(P.AEAD.nonce_length, u8);
-                            const pad = [1]u8{0} ** (P.AEAD.nonce_length - 8);
+                            const pad: [P.AEAD.nonce_length - 8]u8 = @splat(0);
                             const operand: V = pad ++ @as([8]u8, @bitCast(big(read_seq)));
                             break :nonce @as(V, pv.server_handshake_iv) ^ operand;
                         };
                         P.AEAD.decrypt(cleartext, ciphertext, auth_tag, record_header, nonce, pv.server_handshake_key) catch
                             return error.TlsBadRecordMac;
                         // TODO use scalar, non-slice version
-                        cleartext_fragment_end += mem.trimEnd(u8, cleartext, "\x00").len;
+                        const trimmed_len = mem.trimEnd(u8, cleartext, "\x00").len;
+                        if (trimmed_len == 0) return error.TlsDecodeError;
+                        cleartext_fragment_end += trimmed_len;
                     },
                 }
                 read_seq += 1;
@@ -413,7 +415,7 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
                             comptime std.math.shl(u64, std.math.maxInt(u64), 8 * P.record_iv_length);
                         const nonce: [P.AEAD.nonce_length]u8 = nonce: {
                             const V = @Vector(P.AEAD.nonce_length, u8);
-                            const pad = [1]u8{0} ** (P.AEAD.nonce_length - 8);
+                            const pad: [P.AEAD.nonce_length - 8]u8 = @splat(0);
                             const operand: V = pad ++ @as([8]u8, @bitCast(big(masked_read_seq)));
                             break :nonce @as(V, pv.app_cipher.server_write_IV ++ record_iv) ^ operand;
                         };
@@ -537,7 +539,7 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
                                         const p = &@field(handshake_cipher, @tagName(tag.with()));
                                         const P = @TypeOf(p.*).A;
                                         const hello_hash = p.transcript_hash.peek();
-                                        const zeroes = [1]u8{0} ** P.Hash.digest_length;
+                                        const zeroes: [P.Hash.digest_length]u8 = @splat(0);
                                         const early_secret = P.Hkdf.extract(&[1]u8{0}, &zeroes);
                                         const empty_hash = tls.emptyHash(P.Hash);
                                         p.version = .{ .tls_1_3 = undefined };
@@ -789,7 +791,7 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
                                 const pv = &p.version.tls_1_2;
                                 const nonce: [P.AEAD.nonce_length]u8 = nonce: {
                                     const V = @Vector(P.AEAD.nonce_length, u8);
-                                    const pad = [1]u8{0} ** (P.AEAD.nonce_length - 8);
+                                    const pad: [P.AEAD.nonce_length - 8]u8 = @splat(0);
                                     const operand: V = pad ++ @as([8]u8, @bitCast(big(write_seq)));
                                     break :nonce @as(V, pv.app_cipher.client_write_IV ++ pv.app_cipher.client_salt) ^ operand;
                                 };
@@ -830,8 +832,9 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
                         }
                         switch (handshake_cipher) {
                             inline else => |*p| {
+                                const pad: [64]u8 = @splat(' ');
                                 try main_cert_pub_key.verifySignature(&hsd, &.{
-                                    " " ** 64 ++ "TLS 1.3, server CertificateVerify\x00",
+                                    pad ++ "TLS 1.3, server CertificateVerify\x00",
                                     &p.transcript_hash.peek(),
                                 });
                                 p.transcript_hash.update(wrapped_handshake);
@@ -1064,7 +1067,7 @@ fn prepareCiphertextRecord(
                     ciphertext_end += auth_tag.len;
                     const nonce = nonce: {
                         const V = @Vector(P.AEAD.nonce_length, u8);
-                        const pad = [1]u8{0} ** (P.AEAD.nonce_length - 8);
+                        const pad: [P.AEAD.nonce_length - 8]u8 = @splat(0);
                         const operand: V = pad ++ mem.toBytes(big(c.write_seq));
                         break :nonce @as(V, pv.client_iv) ^ operand;
                     };
@@ -1101,7 +1104,7 @@ fn prepareCiphertextRecord(
                     ciphertext_end += P.record_iv_length;
                     const nonce: [P.AEAD.nonce_length]u8 = nonce: {
                         const V = @Vector(P.AEAD.nonce_length, u8);
-                        const pad = [1]u8{0} ** (P.AEAD.nonce_length - 8);
+                        const pad: [P.AEAD.nonce_length - 8]u8 = @splat(0);
                         const operand: V = pad ++ @as([8]u8, @bitCast(big(c.write_seq)));
                         break :nonce @as(V, pv.client_write_IV ++ pv.client_salt) ^ operand;
                     };
@@ -1155,7 +1158,7 @@ fn readIndirect(c: *Client) Reader.Error!usize {
                 return failRead(c, error.TlsConnectionTruncated);
             }
         },
-        error.ReadFailed => return error.ReadFailed,
+        error.ReadFailed => |e| return e,
     };
     const ct: tls.ContentType = @enumFromInt(record_header[0]);
     const legacy_version = mem.readInt(u16, record_header[1..][0..2], .big);
@@ -1166,7 +1169,7 @@ fn readIndirect(c: *Client) Reader.Error!usize {
     if (record_end > input.buffered().len) {
         input.fillMore() catch |err| switch (err) {
             error.EndOfStream => return failRead(c, error.TlsConnectionTruncated),
-            error.ReadFailed => return error.ReadFailed,
+            error.ReadFailed => |e| return e,
         };
         if (record_end > input.buffered().len) return 0;
     }
@@ -1176,13 +1179,14 @@ fn readIndirect(c: *Client) Reader.Error!usize {
             .tls_1_3 => {
                 const pv = &p.tls_1_3;
                 const P = @TypeOf(p.*);
+                if (record_len < P.AEAD.tag_length) return failRead(c, error.TlsRecordOverflow);
                 const ad = input.take(tls.record_header_len) catch unreachable; // already peeked
                 const ciphertext_len = record_len - P.AEAD.tag_length;
                 const ciphertext = input.take(ciphertext_len) catch unreachable; // already peeked
                 const auth_tag = (input.takeArray(P.AEAD.tag_length) catch unreachable).*; // already peeked
                 const nonce = nonce: {
                     const V = @Vector(P.AEAD.nonce_length, u8);
-                    const pad = [1]u8{0} ** (P.AEAD.nonce_length - 8);
+                    const pad: [P.AEAD.nonce_length - 8]u8 = @splat(0);
                     const operand: V = pad ++ mem.toBytes(big(c.read_seq));
                     break :nonce @as(V, pv.server_iv) ^ operand;
                 };
@@ -1192,6 +1196,7 @@ fn readIndirect(c: *Client) Reader.Error!usize {
                     return failRead(c, error.TlsBadRecordMac);
                 // TODO use scalar, non-slice version
                 const msg = mem.trimEnd(u8, cleartext, "\x00");
+                if (msg.len == 0) return failRead(c, error.TlsDecodeError);
                 break :cleartext .{ msg.len - 1, @enumFromInt(msg[msg.len - 1]) };
             },
             .tls_1_2 => {
@@ -1207,7 +1212,7 @@ fn readIndirect(c: *Client) Reader.Error!usize {
                     comptime std.math.shl(u64, std.math.maxInt(u64), 8 * P.record_iv_length);
                 const nonce: [P.AEAD.nonce_length]u8 = nonce: {
                     const V = @Vector(P.AEAD.nonce_length, u8);
-                    const pad = [1]u8{0} ** (P.AEAD.nonce_length - 8);
+                    const pad: [P.AEAD.nonce_length - 8]u8 = @splat(0);
                     const operand: V = pad ++ @as([8]u8, @bitCast(big(masked_read_seq)));
                     break :nonce @as(V, pv.server_write_IV ++ record_iv) ^ operand;
                 };
@@ -1668,3 +1673,74 @@ else
         .AES_256_GCM_SHA384,
         .ECDHE_RSA_WITH_AES_256_GCM_SHA384,
     });
+
+fn testReadError(input_buf: []const u8, cipher: tls.ApplicationCipher) ReadError {
+    var input_reader: Reader = .fixed(input_buf);
+    var read_buf: [tls.max_ciphertext_record_len]u8 = undefined;
+    var c: Client = .{
+        .input = &input_reader,
+        .reader = .{
+            .buffer = &read_buf,
+            .vtable = &.{ .stream = stream, .readVec = readVec },
+            .seek = 0,
+            .end = 0,
+        },
+        .output = undefined,
+        .writer = undefined,
+        .tls_version = .tls_1_3,
+        .read_seq = 0,
+        .write_seq = 0,
+        .received_close_notify = false,
+        .allow_truncation_attacks = false,
+        .application_cipher = cipher,
+        .ssl_key_log = null,
+    };
+    var w: Writer = .failing;
+    std.testing.expectError(error.ReadFailed, c.reader.stream(&w, .unlimited)) catch
+        @panic("expected ReadFailed");
+    return c.read_err.?;
+}
+
+test "empty inner plaintext" {
+    const AEAD = crypto.aead.chacha_poly.ChaCha20Poly1305;
+    const key: [AEAD.key_length]u8 = @splat(0);
+    const iv: [AEAD.nonce_length]u8 = @splat(0);
+
+    const plaintext = [1]u8{0x00};
+    var ciphertext: [plaintext.len]u8 = undefined;
+    var tag: [AEAD.tag_length]u8 = undefined;
+    const content_len: u16 = plaintext.len + AEAD.tag_length;
+    const record_header = [_]u8{ 0x17, 0x03, 0x03 } ++ mem.toBytes(big(content_len));
+    AEAD.encrypt(&ciphertext, &tag, &plaintext, &record_header, iv, key);
+
+    try std.testing.expectEqual(error.TlsDecodeError, testReadError(
+        &record_header ++ ciphertext ++ tag,
+        .{ .CHACHA20_POLY1305_SHA256 = .{ .tls_1_3 = .{
+            .server_key = key,
+            .server_iv = iv,
+            .client_secret = undefined,
+            .server_secret = undefined,
+            .client_key = undefined,
+            .client_iv = undefined,
+        } } },
+    ));
+}
+
+test "record shorter than tag" {
+    const AEAD = crypto.aead.chacha_poly.ChaCha20Poly1305;
+    const record_len: u16 = AEAD.tag_length - 1;
+    const header = [_]u8{ 0x17, 0x03, 0x03 } ++ mem.toBytes(big(record_len));
+    const wire = header ++ @as([record_len]u8, @splat(0));
+
+    try std.testing.expectEqual(error.TlsRecordOverflow, testReadError(
+        &wire,
+        .{ .CHACHA20_POLY1305_SHA256 = .{ .tls_1_3 = .{
+            .server_key = undefined,
+            .server_iv = undefined,
+            .client_secret = undefined,
+            .server_secret = undefined,
+            .client_key = undefined,
+            .client_iv = undefined,
+        } } },
+    ));
+}

package/std/crypto/tls.zig

@@ -666,7 +666,7 @@ pub const Decoder = struct {
         if (request_amt > dest.len) return error.TlsRecordOverflow;
         stream.readSlice(dest[0..request_amt]) catch |err| switch (err) {
             error.EndOfStream => return error.TlsConnectionTruncated,
-            error.ReadFailed => return error.ReadFailed,
+            error.ReadFailed => |e| return e,
         };
         d.cap += request_amt;
     }

package/std/crypto.zig

@@ -367,6 +367,7 @@ test {
     _ = ff;
     _ = errors;
     _ = tls;
+    _ = tls.Client;
     _ = Certificate;
     _ = codecs;
 }
@@ -393,7 +394,7 @@ test "issue #4532: no index out of bounds" {
     };
 
     inline for (types) |Hasher| {
-        var block = [_]u8{'#'} ** Hasher.block_length;
+        var block: [Hasher.block_length]u8 = @splat('#');
         var out1: [Hasher.digest_length]u8 = undefined;
         var out2: [Hasher.digest_length]u8 = undefined;
         const h0 = Hasher.init(.{});
@@ -416,8 +417,8 @@ pub fn secureZero(comptime T: type, s: []volatile T) void {
 }
 
 test secureZero {
-    var a = [_]u8{0xfe} ** 8;
-    var b = [_]u8{0xfe} ** 8;
+    var a: [8]u8 = @splat(0xFE);
+    var b: [8]u8 = @splat(0xFE);
 
     @memset(&a, 0);
     secureZero(u8, &b);