diff --git a/crypto/fipsmodule/cipher/e_aes.c b/crypto/fipsmodule/cipher/e_aes.c
index 54f40abdb7..f72fadd990 100644
--- a/crypto/fipsmodule/cipher/e_aes.c
+++ b/crypto/fipsmodule/cipher/e_aes.c
@@ -490,6 +490,9 @@ static int aes_gcm_ctrl(EVP_CIPHER_CTX *c, int type, int arg, void *ptr) {
       if (gctx->iv_gen == 0 || gctx->key_set == 0 || c->encrypt) {
         return 0;
       }
+      if (arg <= 0 || arg > gctx->ivlen) {
+        return 0;
+      }
       OPENSSL_memcpy(gctx->iv + gctx->ivlen - arg, ptr, arg);
       CRYPTO_gcm128_setiv(&gctx->gcm, &gctx->ks.ks, gctx->iv, gctx->ivlen);
       gctx->iv_set = 1;
diff --git a/crypto/fipsmodule/cipher/e_aesccm.c b/crypto/fipsmodule/cipher/e_aesccm.c
index f5ab2593a2..367a585908 100644
--- a/crypto/fipsmodule/cipher/e_aesccm.c
+++ b/crypto/fipsmodule/cipher/e_aesccm.c
@@ -105,7 +105,7 @@ typedef struct cipher_aes_ccm_ctx {
 #define CCM_INNER_STATE(ccm_ctx) (&ccm_ctx->ccm_state)
 
 // As per RFC3610, the nonce length in bytes is 15 - L.
-#define CCM_L_TO_NONCE_LEN(L) (15 - L)
+#define CCM_L_TO_NONCE_LEN(L) (15 - (L))
 
 static int CRYPTO_ccm128_init(struct ccm128_context *ctx, block128_f block,
                               ctr128_f ctr, unsigned M, unsigned L) {
@@ -665,7 +665,7 @@ static int cipher_aes_ccm_ctrl(EVP_CIPHER_CTX *ctx, int type, int arg,
       cipher_ctx->message_len = 0;
       return 1;
     case EVP_CTRL_GET_IVLEN:
-      *(uint32_t *)ptr = CCM_L_TO_NONCE_LEN(cipher_ctx->L);
+      *(int *)ptr = CCM_L_TO_NONCE_LEN(cipher_ctx->L);
       return 1;
     case EVP_CTRL_AEAD_SET_IVLEN:
       // The nonce (IV) length is 15-L, compute L here and set it below to "set"