diff --git a/library/ccm.c b/library/ccm.c
index ad0d71b00..97eed7bd8 100644
--- a/library/ccm.c
+++ b/library/ccm.c
@@ -323,9 +323,9 @@ int mbedtls_ccm_star_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length,
 {
     CCM_VALIDATE_RET( ctx != NULL );
     CCM_VALIDATE_RET( iv != NULL );
-    CCM_VALIDATE_RET( add != NULL );
-    CCM_VALIDATE_RET( input != NULL );
-    CCM_VALIDATE_RET( output != NULL );
+    CCM_VALIDATE_RET( add_len == 0 || add != NULL );
+    CCM_VALIDATE_RET( length == 0 || input != NULL );
+    CCM_VALIDATE_RET( length == 0 || output != NULL );
     CCM_VALIDATE_RET( tag != NULL );
     return( ccm_auth_crypt( ctx, CCM_ENCRYPT, length, iv, iv_len,
                             add, add_len, input, output, tag, tag_len ) );
@@ -339,9 +339,9 @@ int mbedtls_ccm_encrypt_and_tag( mbedtls_ccm_context *ctx, size_t length,
 {
     CCM_VALIDATE_RET( ctx != NULL );
     CCM_VALIDATE_RET( iv != NULL );
-    CCM_VALIDATE_RET( add != NULL );
-    CCM_VALIDATE_RET( input != NULL );
-    CCM_VALIDATE_RET( output != NULL );
+    CCM_VALIDATE_RET( add_len == 0 || add != NULL );
+    CCM_VALIDATE_RET( length == 0 || input != NULL );
+    CCM_VALIDATE_RET( length == 0 || output != NULL );
     CCM_VALIDATE_RET( tag != NULL );
     if( tag_len == 0 )
         return( MBEDTLS_ERR_CCM_BAD_INPUT );
@@ -366,9 +366,9 @@ int mbedtls_ccm_star_auth_decrypt( mbedtls_ccm_context *ctx, size_t length,
 
     CCM_VALIDATE_RET( ctx != NULL );
     CCM_VALIDATE_RET( iv != NULL );
-    CCM_VALIDATE_RET( add != NULL );
-    CCM_VALIDATE_RET( input != NULL );
-    CCM_VALIDATE_RET( output != NULL );
+    CCM_VALIDATE_RET( add_len == 0 || add != NULL );
+    CCM_VALIDATE_RET( length == 0 || input != NULL );
+    CCM_VALIDATE_RET( length == 0 || output != NULL );
     CCM_VALIDATE_RET( tag != NULL );
 
     if( ( ret = ccm_auth_crypt( ctx, CCM_DECRYPT, length,