Check buffer lengths and HMAC return value in crypto.c
I've made sure that buffer lengths are consistently checked, and that the return value of HMAC is checked in crypto.c.
issue