diff --git a/crypto.go b/crypto.go
index caf45b4..e83df6a 100644
--- a/crypto.go
+++ b/crypto.go
@@ -209,7 +209,11 @@ func (a *bufferedAuthReader) Read(b []byte) (int, error) {
 			a.err = ErrDecryption
 			return 0, a.err
 		}
-		a.mac.Write(a.buf.Bytes())
+		mn, err := a.mac.Write(a.buf.Bytes())
+		if mn != a.buf.Len() || err != nil {
+			a.err = ErrDecryption
+			return 0, a.err
+		}
 		if !a.checkAuthentication(ab.Bytes()) {
 			a.err = ErrDecryption
 			return 0, a.err