Fix ArrayIndexOutOfBoundsException when no space needed

src/com/amazon/corretto/crypto/provider/AesGcmSpi.java

@@ -1006,9 +1006,9 @@ private void checkOutputBuffer(
     if (inputLength < 0 || outputOffset < 0) {
       throw new ArrayIndexOutOfBoundsException();
     }
-    // Allow outputOffset to index into a 0-length empty array. We must trust that the rest of the
-    // code doesn't actually do this.
-    if (outputOffset > output.length || (outputOffset == output.length && output.length != 0)) {
+    // We only allow outputOffset == output.length if we don't actually need any space for data
+    if (outputOffset > output.length
+        || (outputOffset == output.length && requiredBufferSpace > 0)) {
       throw new ArrayIndexOutOfBoundsException();
     }
 

tst/com/amazon/corretto/crypto/provider/test/AesTest.java

@@ -1383,6 +1383,23 @@ public void arrayIndexDoesNotResetEncrypt() throws Exception {
     assertArraysHexEquals(plaintext, amznC.doFinal(ciphertext));
   }
 
+  @Test
+  public void emptyPlaintextAtEndOfArray() throws GeneralSecurityException {
+    final GCMParameterSpec spec = new GCMParameterSpec(128, randomIV());
+    amznC.init(Cipher.ENCRYPT_MODE, key, spec);
+    final byte[] ciphertext = amznC.doFinal();
+
+    // Decrypt into empty array
+    amznC.init(Cipher.DECRYPT_MODE, key, spec);
+    assertEquals(0, amznC.doFinal(ciphertext, 0, ciphertext.length, new byte[0], 0));
+
+    // Decrypt into non-empty array
+    assertEquals(0, amznC.doFinal(ciphertext, 0, ciphertext.length, new byte[16], 0));
+
+    // Decrypt to end of non-empty array
+    assertEquals(0, amznC.doFinal(ciphertext, 0, ciphertext.length, new byte[16], 16));
+  }
+
   private byte[] randomIV() {
     return TestUtil.getRandomBytes(16);
   }