diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index a116bef..672a97d 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -6076,9 +6076,10 @@
 #if defined(PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128)
     if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
 #if (SIZE_MAX > UINT32_MAX)
-        operation->capacity = UINT32_MAX * PSA_MAC_LENGTH(PSA_KEY_TYPE_AES,
-                                                          128U,
-                                                          PSA_ALG_CMAC);
+        operation->capacity = UINT32_MAX * (size_t)PSA_MAC_LENGTH(
+            PSA_KEY_TYPE_AES,
+            128U,
+            PSA_ALG_CMAC);
 #else
         operation->capacity = SIZE_MAX;
 #endif
@@ -6090,6 +6091,9 @@
      * invalid or meaningless but it does not affect this function */
     psa_algorithm_t hash_alg = PSA_ALG_GET_HASH(kdf_alg);
     size_t hash_size = PSA_HASH_LENGTH(hash_alg);
+    if (hash_size == 0) {
+        return PSA_ERROR_NOT_SUPPORTED;
+    }
 
     /* Make sure that hash_alg is a supported hash algorithm. Otherwise
      * we might fail later, which is somewhat unfriendly and potentially
@@ -6138,6 +6142,7 @@
     } else
 #endif /* PSA_WANT_ALG_PBKDF2_HMAC */
     {
+        (void) hash_size;
         status = PSA_ERROR_NOT_SUPPORTED;
     }
     return status;