Make base16_decodes return number of decoded bytes

base16_decodes() now returns the number of decoded bytes. It's interface
changes from returning a "int" to a "ssize_t". Every callsite now checks the
returned value.

Fixes #14013

Signed-off-by: David Goulet <dgoulet@torproject.org>

17 files changed, 89 insertions, 58 deletions

diff --git a/src/common/util_format.c b/src/common/util_format.c
index f343a9d921..f6d330372f 100644
--- a/src/common/util_format.c
+++ b/src/common/util_format.c
@@ -516,18 +516,21 @@ hex_decode_digit(char c)
   return hex_decode_digit_(c);
 }
 
-/** Given a hexadecimal string of <b>srclen</b> bytes in <b>src</b>, decode it
- * and store the result in the <b>destlen</b>-byte buffer at <b>dest</b>.
- * Return 0 on success, -1 on failure. */
+/** Given a hexadecimal string of <b>srclen</b> bytes in <b>src</b>, decode
+ * it and store the result in the <b>destlen</b>-byte buffer at <b>dest</b>.
+ * Return the number of bytes decoded on success, -1 on failure. If
+ * <b>destlen</b> is greater than INT_MAX or less than half of
+ * <b>srclen</b>, -1 is returned. */
 int
 base16_decode(char *dest, size_t destlen, const char *src, size_t srclen)
 {
   const char *end;
-
+  char *dest_orig = dest;
   int v1,v2;
+
   if ((srclen % 2) != 0)
     return -1;
-  if (destlen < srclen/2 || destlen > SIZE_T_CEILING)
+  if (destlen < srclen/2 || destlen > INT_MAX)
     return -1;
 
   memset(dest, 0, destlen);
@@ -542,6 +545,9 @@ base16_decode(char *dest, size_t destlen, const char *src, size_t srclen)
     ++dest;
     src+=2;
   }
-  return 0;
+
+  tor_assert((dest-dest_orig) <= (ptrdiff_t) destlen);
+
+  return (int) (dest-dest_orig);
 }
 
diff --git a/src/or/circuituse.c b/src/or/circuituse.c
index d2c05bd66e..f344703331 100644
--- a/src/or/circuituse.c
+++ b/src/or/circuituse.c
@@ -2028,7 +2028,8 @@ circuit_get_open_circ_or_launch(entry_connection_t *conn,
             char *hexdigest = conn->chosen_exit_name+1;
             tor_addr_t addr;
             if (strlen(hexdigest) < HEX_DIGEST_LEN ||
-                base16_decode(digest,DIGEST_LEN,hexdigest,HEX_DIGEST_LEN)<0) {
+                base16_decode(digest,DIGEST_LEN,
+                              hexdigest,HEX_DIGEST_LEN) != DIGEST_LEN) {
               log_info(LD_DIR, "Broken exit digest on tunnel conn. Closing.");
               return -1;
             }
diff --git a/src/or/config.c b/src/or/config.c
index 8a3fb47790..cdd4f10e92 100644
--- a/src/or/config.c
+++ b/src/or/config.c
@@ -5330,7 +5330,7 @@ parse_bridge_line(const char *line)
       goto err;
     }
     if (base16_decode(bridge_line->digest, DIGEST_LEN,
-                      fingerprint, HEX_DIGEST_LEN)<0) {
+                      fingerprint, HEX_DIGEST_LEN) != DIGEST_LEN) {
       log_warn(LD_CONFIG, "Unable to decode Bridge key digest.");
       goto err;
     }
@@ -5781,7 +5781,8 @@ parse_dir_authority_line(const char *line, dirinfo_type_t required_type,
     } else if (!strcasecmpstart(flag, "v3ident=")) {
       char *idstr = flag + strlen("v3ident=");
       if (strlen(idstr) != HEX_DIGEST_LEN ||
-          base16_decode(v3_digest, DIGEST_LEN, idstr, HEX_DIGEST_LEN)<0) {
+          base16_decode(v3_digest, DIGEST_LEN,
+                        idstr, HEX_DIGEST_LEN) != DIGEST_LEN) {
         log_warn(LD_CONFIG, "Bad v3 identity digest '%s' on DirAuthority line",
                  flag);
       } else {
@@ -5830,7 +5831,8 @@ parse_dir_authority_line(const char *line, dirinfo_type_t required_type,
              fingerprint, (int)strlen(fingerprint));
     goto err;
   }
-  if (base16_decode(digest, DIGEST_LEN, fingerprint, HEX_DIGEST_LEN)<0) {
+  if (base16_decode(digest, DIGEST_LEN,
+                    fingerprint, HEX_DIGEST_LEN) != DIGEST_LEN) {
     log_warn(LD_CONFIG, "Unable to decode DirAuthority key digest.");
     goto err;
   }
@@ -5898,8 +5900,8 @@ parse_dir_fallback_line(const char *line,
       orport = (int)tor_parse_long(cp+strlen("orport="), 10,
                                    1, 65535, &ok, NULL);
     } else if (!strcmpstart(cp, "id=")) {
-      ok = !base16_decode(id, DIGEST_LEN,
-                          cp+strlen("id="), strlen(cp)-strlen("id="));
+      ok = base16_decode(id, DIGEST_LEN, cp+strlen("id="),
+                         strlen(cp)-strlen("id=")) == DIGEST_LEN;
     } else if (!strcasecmpstart(cp, "ipv6=")) {
       if (ipv6_addrport_ptr) {
         log_warn(LD_CONFIG, "Redundant ipv6 addr/port on FallbackDir line");
diff --git a/src/or/control.c b/src/or/control.c
index 1e90135e21..f956307c0e 100644
--- a/src/or/control.c
+++ b/src/or/control.c
@@ -1211,7 +1211,8 @@ decode_hashed_passwords(config_line_t *passwords)
     const char *hashed = cl->value;
 
     if (!strcmpstart(hashed, "16:")) {
-      if (base16_decode(decoded, sizeof(decoded), hashed+3, strlen(hashed+3))<0
+      if (base16_decode(decoded, sizeof(decoded), hashed+3, strlen(hashed+3))
+                        != S2K_RFC2440_SPECIFIER_LEN + DIGEST_LEN
           || strlen(hashed+3) != (S2K_RFC2440_SPECIFIER_LEN+DIGEST_LEN)*2) {
         goto err;
       }
@@ -1262,7 +1263,8 @@ handle_control_authenticate(control_connection_t *conn, uint32_t len,
     tor_assert(i>0);
     password_len = i/2;
     password = tor_malloc(password_len + 1);
-    if (base16_decode(password, password_len+1, body, i)<0) {
+    if (base16_decode(password, password_len+1, body, i)
+                      != (int) (password_len+1)) {
       connection_write_str_to_buf(
             "551 Invalid hexadecimal encoding.  Maybe you tried a plain text "
             "password?  If so, the standard requires that you put it in "
@@ -2026,7 +2028,8 @@ getinfo_helper_dir(control_connection_t *control_conn,
     if (strlen(question) == HEX_DIGEST_LEN) {
       char d[DIGEST_LEN];
       signed_descriptor_t *sd = NULL;
-      if (base16_decode(d, sizeof(d), question, strlen(question))==0) {
+      if (base16_decode(d, sizeof(d), question, strlen(question))
+                        != sizeof(d)) {
         /* XXXX this test should move into extrainfo_get_by_descriptor_digest,
          * but I don't want to risk affecting other parts of the code,
          * especially since the rules for using our own extrainfo (including
@@ -3442,7 +3445,8 @@ handle_control_authchallenge(control_connection_t *conn, uint32_t len,
     client_nonce = tor_malloc_zero(client_nonce_len);
 
     if (base16_decode(client_nonce, client_nonce_len,
-                      cp, client_nonce_encoded_len) < 0) {
+                      cp, client_nonce_encoded_len)
+                      != (int) client_nonce_len) {
       connection_write_str_to_buf("513 Invalid base16 client nonce\r\n",
                                   conn);
       connection_mark_for_close(TO_CONN(conn));
diff --git a/src/or/directory.c b/src/or/directory.c
index 6caca11737..876eaa4415 100644
--- a/src/or/directory.c
+++ b/src/or/directory.c
@@ -873,7 +873,7 @@ connection_dir_retry_bridges(smartlist_t *descs)
   char digest[DIGEST_LEN];
   SMARTLIST_FOREACH(descs, const char *, cp,
   {
-    if (base16_decode(digest, DIGEST_LEN, cp, strlen(cp))<0) {
+    if (base16_decode(digest, DIGEST_LEN, cp, strlen(cp)) != DIGEST_LEN) {
       log_warn(LD_BUG, "Malformed fingerprint in list: %s",
               escaped(cp));
       continue;
@@ -2682,7 +2682,8 @@ client_likes_consensus(networkstatus_t *v, const char *want_url)
     if (want_len > DIGEST_LEN)
       want_len = DIGEST_LEN;
 
-    if (base16_decode(want_digest, DIGEST_LEN, d, want_len*2) < 0) {
+    if (base16_decode(want_digest, DIGEST_LEN, d, want_len*2)
+                      != (int) want_len) {
       log_fn(LOG_PROTOCOL_WARN, LD_DIR,
              "Failed to decode requested authority digest %s.", escaped(d));
       continue;
@@ -3990,7 +3991,7 @@ dir_routerdesc_download_failed(smartlist_t *failed, int status_code,
   }
   SMARTLIST_FOREACH_BEGIN(failed, const char *, cp) {
     download_status_t *dls = NULL;
-    if (base16_decode(digest, DIGEST_LEN, cp, strlen(cp)) < 0) {
+    if (base16_decode(digest, DIGEST_LEN, cp, strlen(cp)) != DIGEST_LEN) {
       log_warn(LD_BUG, "Malformed fingerprint in list: %s", escaped(cp));
       continue;
     }
@@ -4087,9 +4088,10 @@ dir_split_resource_into_fingerprint_pairs(const char *res,
              "Skipping digest pair %s with missing dash.", escaped(cp));
     } else {
       fp_pair_t pair;
-      if (base16_decode(pair.first, DIGEST_LEN, cp, HEX_DIGEST_LEN)<0 ||
-          base16_decode(pair.second,
-                        DIGEST_LEN, cp+HEX_DIGEST_LEN+1, HEX_DIGEST_LEN)<0) {
+      if (base16_decode(pair.first, DIGEST_LEN,
+                        cp, HEX_DIGEST_LEN) != DIGEST_LEN ||
+          base16_decode(pair.second,DIGEST_LEN,
+                        cp+HEX_DIGEST_LEN+1, HEX_DIGEST_LEN) != DIGEST_LEN) {
         log_info(LD_DIR, "Skipping non-decodable digest pair %s", escaped(cp));
       } else {
         smartlist_add(pairs_result, tor_memdup(&pair, sizeof(pair)));
@@ -4167,8 +4169,9 @@ dir_split_resource_into_fingerprints(const char *resource,
       }
       d = tor_malloc_zero(digest_len);
       if (decode_hex ?
-          (base16_decode(d, digest_len, cp, hex_digest_len)<0) :
-          (base64_decode(d, digest_len, cp, base64_digest_len)<0)) {
+          (base16_decode(d, digest_len, cp, hex_digest_len) != digest_len) :
+          (base64_decode(d, digest_len, cp, base64_digest_len)
+                         != digest_len)) {
           log_info(LD_DIR, "Skipping non-decodable digest %s", escaped(cp));
           smartlist_del_keeporder(fp_tmp, i--);
           goto again;
diff --git a/src/or/dirserv.c b/src/or/dirserv.c
index fa698701c3..e616373b61 100644
--- a/src/or/dirserv.c
+++ b/src/or/dirserv.c
@@ -122,7 +122,8 @@ add_fingerprint_to_dir(const char *fp, authdir_config_t *list,
 
   fingerprint = tor_strdup(fp);
   tor_strstrip(fingerprint, " ");
-  if (base16_decode(d, DIGEST_LEN, fingerprint, strlen(fingerprint))) {
+  if (base16_decode(d, DIGEST_LEN,
+                    fingerprint, strlen(fingerprint)) != DIGEST_LEN) {
     log_warn(LD_DIRSERV, "Couldn't decode fingerprint \"%s\"",
              escaped(fp));
     tor_free(fingerprint);
@@ -199,7 +200,7 @@ dirserv_load_fingerprint_file(void)
     tor_strstrip(fingerprint, " "); /* remove spaces */
     if (strlen(fingerprint) != HEX_DIGEST_LEN ||
         base16_decode(digest_tmp, sizeof(digest_tmp),
-                      fingerprint, HEX_DIGEST_LEN) < 0) {
+                      fingerprint, HEX_DIGEST_LEN) != sizeof(digest_tmp)) {
       log_notice(LD_CONFIG,
                  "Invalid fingerprint (nickname '%s', "
                  "fingerprint %s). Skipping.",
@@ -2274,7 +2275,8 @@ guardfraction_file_parse_guard_line(const char *guard_line,
 
   inputs_tmp = smartlist_get(sl, 0);
   if (strlen(inputs_tmp) != HEX_DIGEST_LEN ||
-      base16_decode(guard_id, DIGEST_LEN, inputs_tmp, HEX_DIGEST_LEN)) {
+      base16_decode(guard_id, DIGEST_LEN,
+                    inputs_tmp, HEX_DIGEST_LEN) != DIGEST_LEN) {
     tor_asprintf(err_msg, "bad digest '%s'", inputs_tmp);
     goto done;
   }
@@ -2578,7 +2580,8 @@ measured_bw_line_parse(measured_bw_line_t *out, const char *orig_line)
       cp+=strlen("node_id=$");
 
       if (strlen(cp) != HEX_DIGEST_LEN ||
-          base16_decode(out->node_id, DIGEST_LEN, cp, HEX_DIGEST_LEN)) {
+          base16_decode(out->node_id, DIGEST_LEN,
+                        cp, HEX_DIGEST_LEN) != DIGEST_LEN) {
         log_warn(LD_DIRSERV, "Invalid node_id in bandwidth file line: %s",
                  escaped(orig_line));
         tor_free(line);
diff --git a/src/or/entrynodes.c b/src/or/entrynodes.c
index 1a31aa4822..bd64dc4421 100644
--- a/src/or/entrynodes.c
+++ b/src/or/entrynodes.c
@@ -1253,7 +1253,7 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg)
       } else {
         strlcpy(node->nickname, smartlist_get(args,0), MAX_NICKNAME_LEN+1);
         if (base16_decode(node->identity, DIGEST_LEN, smartlist_get(args,1),
-                          strlen(smartlist_get(args,1)))<0) {
+                          strlen(smartlist_get(args,1))) != DIGEST_LEN) {
           *msg = tor_strdup("Unable to parse entry nodes: "
                             "Bad hex digest for EntryGuard");
         }
@@ -1309,8 +1309,9 @@ entry_guards_parse_state(or_state_t *state, int set, char **msg)
         log_warn(LD_BUG, "EntryGuardAddedBy line is not long enough.");
         continue;
       }
-      if (base16_decode(d, sizeof(d), line->value, HEX_DIGEST_LEN)<0 ||
-          line->value[HEX_DIGEST_LEN] != ' ') {
+      if (base16_decode(d, sizeof(d),
+                        line->value, HEX_DIGEST_LEN) != sizeof(d) ||
+                        line->value[HEX_DIGEST_LEN] != ' ') {
         log_warn(LD_BUG, "EntryGuardAddedBy line %s does not begin with "
                  "hex digest", escaped(line->value));
         continue;
diff --git a/src/or/networkstatus.c b/src/or/networkstatus.c
index 5a91dda386..da51698da4 100644
--- a/src/or/networkstatus.c
+++ b/src/or/networkstatus.c
@@ -2216,7 +2216,7 @@ getinfo_helper_networkstatus(control_connection_t *conn,
     if (*q == '$')
       ++q;
 
-    if (base16_decode(d, DIGEST_LEN, q, strlen(q))) {
+    if (base16_decode(d, DIGEST_LEN, q, strlen(q)) != DIGEST_LEN) {
       *errmsg = "Data not decodeable as hex";
       return -1;
     }
diff --git a/src/or/rephist.c b/src/or/rephist.c
index 72933550ed..8992571c52 100644
--- a/src/or/rephist.c
+++ b/src/or/rephist.c
@@ -1074,7 +1074,8 @@ rep_hist_load_mtbf_data(time_t now)
       if (mtbf_idx > i)
         i = mtbf_idx;
     }
-    if (base16_decode(digest, DIGEST_LEN, hexbuf, HEX_DIGEST_LEN) < 0) {
+    if (base16_decode(digest, DIGEST_LEN,
+                      hexbuf, HEX_DIGEST_LEN) != DIGEST_LEN) {
       log_warn(LD_HIST, "Couldn't hex string %s", escaped(hexbuf));
       continue;
     }
diff --git a/src/or/routerlist.c b/src/or/routerlist.c
index aaa8fad178..bdb3d490c7 100644
--- a/src/or/routerlist.c
+++ b/src/or/routerlist.c
@@ -2685,7 +2685,8 @@ hex_digest_nickname_decode(const char *hexdigest,
     return -1;
   }
 
-  if (base16_decode(digest_out, DIGEST_LEN, hexdigest, HEX_DIGEST_LEN)<0)
+  if (base16_decode(digest_out, DIGEST_LEN,
+                    hexdigest, HEX_DIGEST_LEN) != DIGEST_LEN)
     return -1;
   return 0;
 }
@@ -2770,7 +2771,7 @@ hexdigest_to_digest(const char *hexdigest, char *digest)
   if (hexdigest[0]=='$')
     ++hexdigest;
   if (strlen(hexdigest) < HEX_DIGEST_LEN ||
-      base16_decode(digest,DIGEST_LEN,hexdigest,HEX_DIGEST_LEN) < 0)
+      base16_decode(digest,DIGEST_LEN,hexdigest,HEX_DIGEST_LEN) != DIGEST_LEN)
     return -1;
   return 0;
 }
diff --git a/src/or/routerparse.c b/src/or/routerparse.c
index cefe607fc6..130f9f4aa1 100644
--- a/src/or/routerparse.c
+++ b/src/or/routerparse.c
@@ -1513,7 +1513,8 @@ router_parse_entry_from_string(const char *s, const char *end,
     char d[DIGEST_LEN];
     tor_assert(tok->n_args == 1);
     tor_strstrip(tok->args[0], " ");
-    if (base16_decode(d, DIGEST_LEN, tok->args[0], strlen(tok->args[0]))) {
+    if (base16_decode(d, DIGEST_LEN,
+                      tok->args[0], strlen(tok->args[0])) != DIGEST_LEN) {
       log_warn(LD_DIR, "Couldn't decode router fingerprint %s",
                escaped(tok->args[0]));
       goto err;
@@ -1594,8 +1595,10 @@ router_parse_entry_from_string(const char *s, const char *end,
   if ((tok = find_opt_by_keyword(tokens, K_EXTRA_INFO_DIGEST))) {
     tor_assert(tok->n_args >= 1);
     if (strlen(tok->args[0]) == HEX_DIGEST_LEN) {
-      base16_decode(router->cache_info.extra_info_digest,
-                    DIGEST_LEN, tok->args[0], HEX_DIGEST_LEN);
+      if (base16_decode(router->cache_info.extra_info_digest, DIGEST_LEN,
+                        tok->args[0], HEX_DIGEST_LEN) != DIGEST_LEN) {
+          log_warn(LD_DIR,"Invalid extra info digest");
+      }
     } else {
       log_warn(LD_DIR, "Invalid extra info digest %s", escaped(tok->args[0]));
     }
@@ -1738,7 +1741,7 @@ extrainfo_parse_entry_from_string(const char *s, const char *end,
   strlcpy(extrainfo->nickname, tok->args[0], sizeof(extrainfo->nickname));
   if (strlen(tok->args[1]) != HEX_DIGEST_LEN ||
       base16_decode(extrainfo->cache_info.identity_digest, DIGEST_LEN,
-                    tok->args[1], HEX_DIGEST_LEN)) {
+                    tok->args[1], HEX_DIGEST_LEN) != DIGEST_LEN) {
     log_warn(LD_DIR,"Invalid fingerprint %s on \"extra-info\"",
              escaped(tok->args[1]));
     goto err;
@@ -1960,7 +1963,7 @@ authority_cert_parse_from_string(const char *s, const char **end_of_string)
   tok = find_by_keyword(tokens, K_FINGERPRINT);
   tor_assert(tok->n_args);
   if (base16_decode(fp_declared, DIGEST_LEN, tok->args[0],
-                    strlen(tok->args[0]))) {
+                    strlen(tok->args[0])) != DIGEST_LEN) {
     log_warn(LD_DIR, "Couldn't decode key certificate fingerprint %s",
              escaped(tok->args[0]));
     goto err;
@@ -3097,7 +3100,8 @@ networkstatus_parse_vote_from_string(const char *s, const char **eos_out,
       voter->nickname = tor_strdup(tok->args[0]);
       if (strlen(tok->args[1]) != HEX_DIGEST_LEN ||
           base16_decode(voter->identity_digest, sizeof(voter->identity_digest),
-                        tok->args[1], HEX_DIGEST_LEN) < 0) {
+                        tok->args[1], HEX_DIGEST_LEN)
+                        != sizeof(voter->identity_digest)) {
         log_warn(LD_DIR, "Error decoding identity digest %s in "
                  "network-status document.", escaped(tok->args[1]));
         goto err;
@@ -3146,7 +3150,8 @@ networkstatus_parse_vote_from_string(const char *s, const char **eos_out,
       }
       if (strlen(tok->args[0]) != HEX_DIGEST_LEN ||
         base16_decode(voter->vote_digest, sizeof(voter->vote_digest),
-                      tok->args[0], HEX_DIGEST_LEN) < 0) {
+                      tok->args[0], HEX_DIGEST_LEN)
+                      != sizeof(voter->vote_digest)) {
         log_warn(LD_DIR, "Error decoding vote digest %s in "
                  "network-status consensus.", escaped(tok->args[0]));
         goto err;
@@ -3171,7 +3176,7 @@ networkstatus_parse_vote_from_string(const char *s, const char **eos_out,
     if (strlen(tok->args[0]) == HEX_DIGEST_LEN) {
       networkstatus_voter_info_t *voter = smartlist_get(ns->voters, 0);
       if (base16_decode(voter->legacy_id_digest, DIGEST_LEN,
-                        tok->args[0], HEX_DIGEST_LEN)<0)
+                        tok->args[0], HEX_DIGEST_LEN) != DIGEST_LEN)
         bad = 1;
       else
         bad = 0;
@@ -3330,7 +3335,8 @@ networkstatus_parse_vote_from_string(const char *s, const char **eos_out,
 
     if (strlen(id_hexdigest) != HEX_DIGEST_LEN ||
         base16_decode(declared_identity, sizeof(declared_identity),
-                      id_hexdigest, HEX_DIGEST_LEN) < 0) {
+                      id_hexdigest, HEX_DIGEST_LEN)
+                      != sizeof(declared_identity)) {
       log_warn(LD_DIR, "Error decoding declared identity %s in "
                "network-status document.", escaped(id_hexdigest));
       goto err;
@@ -3345,7 +3351,8 @@ networkstatus_parse_vote_from_string(const char *s, const char **eos_out,
     sig->alg = alg;
     if (strlen(sk_hexdigest) != HEX_DIGEST_LEN ||
         base16_decode(sig->signing_key_digest, sizeof(sig->signing_key_digest),
-                      sk_hexdigest, HEX_DIGEST_LEN) < 0) {
+                      sk_hexdigest, HEX_DIGEST_LEN)
+                      != sizeof(sig->signing_key_digest)) {
       log_warn(LD_DIR, "Error decoding declared signing key digest %s in "
                "network-status document.", escaped(sk_hexdigest));
       tor_free(sig);
@@ -3547,7 +3554,7 @@ networkstatus_parse_detached_signatures(const char *s, const char *eos)
       continue;
     }
     if (base16_decode(digests->d[alg], digest_length,
-                      hexdigest, strlen(hexdigest)) < 0) {
+                      hexdigest, strlen(hexdigest)) != (int) digest_length) {
       log_warn(LD_DIR, "Bad encoding on consensus-digest in detached "
                "networkstatus signatures");
       goto err;
@@ -3620,14 +3627,14 @@ networkstatus_parse_detached_signatures(const char *s, const char *eos)
 
     if (strlen(id_hexdigest) != HEX_DIGEST_LEN ||
         base16_decode(id_digest, sizeof(id_digest),
-                      id_hexdigest, HEX_DIGEST_LEN) < 0) {
+                      id_hexdigest, HEX_DIGEST_LEN) != sizeof(id_digest)) {
       log_warn(LD_DIR, "Error decoding declared identity %s in "
                "network-status vote.", escaped(id_hexdigest));
       goto err;
     }
     if (strlen(sk_hexdigest) != HEX_DIGEST_LEN ||
         base16_decode(sk_digest, sizeof(sk_digest),
-                      sk_hexdigest, HEX_DIGEST_LEN) < 0) {
+                      sk_hexdigest, HEX_DIGEST_LEN) != sizeof(sk_digest)) {
       log_warn(LD_DIR, "Error decoding declared signing key digest %s in "
                "network-status vote.", escaped(sk_hexdigest));
       goto err;
@@ -4829,7 +4836,7 @@ tor_version_parse(const char *s, tor_version_t *out)
     memwipe(digest, 0, sizeof(digest));
     if ( hexlen == 0 || (hexlen % 2) == 1)
       return -1;
-    if (base16_decode(digest, hexlen/2, cp, hexlen))
+    if (base16_decode(digest, hexlen/2, cp, hexlen) != hexlen/2)
       return -1;
     memcpy(out->git_tag, digest, hexlen/2);
     out->git_tag_len = hexlen/2;
diff --git a/src/test/test_crypto.c b/src/test/test_crypto.c
index bf4b68efe2..ba2fb86246 100644
--- a/src/test/test_crypto.c
+++ b/src/test/test_crypto.c
@@ -1521,7 +1521,7 @@ test_crypto_formats(void *arg)
 
   strlcpy(data1, "f0d678affc000100", 1024);
   i = base16_decode(data2, 8, data1, 16);
-  tt_int_op(i,OP_EQ, 0);
+  tt_int_op(i,OP_EQ, 8);
   tt_mem_op(data2,OP_EQ, "\xf0\xd6\x78\xaf\xfc\x00\x01\x00",8);
 
   /* now try some failing base16 decodes */
@@ -2537,8 +2537,9 @@ test_crypto_ed25519_testvectors(void *arg)
 #define DECODE(p,s) base16_decode((char*)(p),sizeof(p),(s),strlen(s))
 #define EQ(a,h) test_memeq_hex((const char*)(a), (h))
 
-    tt_int_op(0, OP_EQ, DECODE(sk, ED25519_SECRET_KEYS[i]));
-    tt_int_op(0, OP_EQ, DECODE(blinding_param, ED25519_BLINDING_PARAMS[i]));
+    tt_int_op(sizeof(sk), OP_EQ, DECODE(sk, ED25519_SECRET_KEYS[i]));
+    tt_int_op(sizeof(blinding_param), OP_EQ, DECODE(blinding_param,
+              ED25519_BLINDING_PARAMS[i]));
 
     tt_int_op(0, OP_EQ, ed25519_secret_key_from_seed(&esk, sk));
     EQ(esk.seckey, ED25519_EXPANDED_SECRET_KEYS[i]);
diff --git a/src/test/test_dir.c b/src/test/test_dir.c
index 74b753a1ea..b7d58bd577 100644
--- a/src/test/test_dir.c
+++ b/src/test/test_dir.c
@@ -580,7 +580,7 @@ test_dir_extrainfo_parsing(void *arg)
     crypto_pk_t *pk = ri->identity_pkey = crypto_pk_new();              \
     tt_assert(! crypto_pk_read_public_key_from_string(pk,               \
                                       name##_KEY, strlen(name##_KEY))); \
-    tt_int_op(0,OP_EQ,base16_decode(d, 20, name##_FP, strlen(name##_FP))); \
+    tt_int_op(20,OP_EQ,base16_decode(d, 20, name##_FP, strlen(name##_FP))); \
     digestmap_set((digestmap_t*)map, d, ri);                            \
     ri = NULL;                                                          \
   } while (0)
diff --git a/src/test/test_guardfraction.c b/src/test/test_guardfraction.c
index 300590a3d9..130aff11aa 100644
--- a/src/test/test_guardfraction.c
+++ b/src/test/test_guardfraction.c
@@ -40,7 +40,7 @@ gen_vote_routerstatus_for_tests(const char *digest_in_hex, int is_guard)
     tt_int_op(strlen(digest_in_hex), ==, HEX_DIGEST_LEN);
     retval = base16_decode(digest_tmp, sizeof(digest_tmp),
                            digest_in_hex, HEX_DIGEST_LEN);
-    tt_int_op(retval, ==, 0);
+    tt_int_op(retval, ==, sizeof(digest_tmp));
     memcpy(rs->identity_digest, digest_tmp, DIGEST_LEN);
   }
 
diff --git a/src/test/test_microdesc.c b/src/test/test_microdesc.c
index be90f53196..2afbdde88a 100644
--- a/src/test/test_microdesc.c
+++ b/src/test/test_microdesc.c
@@ -783,7 +783,8 @@ test_md_reject_cache(void *arg)
   mc = get_microdesc_cache();
 #define ADD(hex)                                                        \
   do {                                                                  \
-    tt_int_op(0,OP_EQ,base16_decode(buf,sizeof(buf),hex,strlen(hex)));     \
+    tt_int_op(sizeof(buf),OP_EQ,base16_decode(buf,sizeof(buf),          \
+                hex,strlen(hex)));\
     smartlist_add(wanted, tor_memdup(buf, DIGEST256_LEN));              \
   } while (0)
 
diff --git a/src/test/test_ntor_cl.c b/src/test/test_ntor_cl.c
index 49c9ad76d4..a560e5fc5e 100644
--- a/src/test/test_ntor_cl.c
+++ b/src/test/test_ntor_cl.c
@@ -21,7 +21,7 @@
   } STMT_END
 #define BASE16(idx, var, n) STMT_BEGIN {                                \
     const char *s = argv[(idx)];                                        \
-    if (base16_decode((char*)var, n, s, strlen(s)) < 0 ) {              \
+    if (base16_decode((char*)var, n, s, strlen(s)) < (int)n ) {              \
       fprintf(stderr, "couldn't decode argument %d (%s)\n",idx,s);      \
       return 1;                                                         \
     }                                                                   \
diff --git a/src/test/test_util_format.c b/src/test/test_util_format.c
index c27b3a50eb..54603bfc0e 100644
--- a/src/test/test_util_format.c
+++ b/src/test/test_util_format.c
@@ -270,7 +270,7 @@ test_util_format_base16_decode(void *ignored)
   tt_int_op(res, OP_EQ, 0);
 
   res = base16_decode(dst, 1000, "aabc", 4);
-  tt_int_op(res, OP_EQ, 0);
+  tt_int_op(res, OP_EQ, 2);
   tt_mem_op(dst, OP_EQ, "\xaa\xbc", 2);
 
   res = base16_decode(dst, 1000, "aabcd", 6);
@@ -280,7 +280,7 @@ test_util_format_base16_decode(void *ignored)
   tt_int_op(res, OP_EQ, -1);
 
   res = base16_decode(real_dst, 10, real_src, 14);
-  tt_int_op(res, OP_EQ, 0);
+  tt_int_op(res, OP_EQ, 7);
   tt_mem_op(real_dst, OP_EQ, expected, 7);
 
  done: