diff --git a/libfreerdp/core/security.c b/libfreerdp/core/security.c
index 68505fb3e..653bf0a5b 100644
--- a/libfreerdp/core/security.c
+++ b/libfreerdp/core/security.c
@@ -304,7 +304,7 @@ static void security_UINT32_le(BYTE* output, size_t out_len, UINT32 value)
 }
 
 BOOL security_mac_data(const BYTE* mac_salt_key, size_t mac_salt_key_length, const BYTE* data,
-                       UINT32 length, BYTE* output, size_t output_length)
+                       size_t length, BYTE* output, size_t output_length)
 {
 	WINPR_DIGEST_CTX* sha1 = NULL;
 	WINPR_DIGEST_CTX* md5 = NULL;
@@ -312,6 +312,7 @@ BOOL security_mac_data(const BYTE* mac_salt_key, size_t mac_salt_key_length, con
 	BYTE sha1_digest[WINPR_SHA1_DIGEST_LENGTH] = { 0 };
 	BOOL result = FALSE;
 
+	WINPR_ASSERT(length <= UINT32_MAX);
 	WINPR_ASSERT(mac_salt_key_length == WINPR_MD5_DIGEST_LENGTH);
 	WINPR_ASSERT(output_length == WINPR_MD5_DIGEST_LENGTH);
 
@@ -367,6 +368,8 @@ BOOL security_mac_data(const BYTE* mac_salt_key, size_t mac_salt_key_length, con
 
 	result = TRUE;
 out:
+	if (!result)
+		WLog_ERR(TAG, "failed to create security mac");
 	winpr_Digest_Free(sha1);
 	winpr_Digest_Free(md5);
 	return result;
diff --git a/libfreerdp/core/security.h b/libfreerdp/core/security.h
index 326ff8496..b072fd6ab 100644
--- a/libfreerdp/core/security.h
+++ b/libfreerdp/core/security.h
@@ -46,7 +46,7 @@ FREERDP_LOCAL BOOL security_licensing_encryption_key(const BYTE* session_key_blo
                                                      size_t server_len, BYTE* output,
                                                      size_t out_len);
 FREERDP_LOCAL BOOL security_mac_data(const BYTE* mac_salt_key, size_t mac_salt_key_length,
-                                     const BYTE* data, UINT32 length, BYTE* output,
+                                     const BYTE* data, size_t length, BYTE* output,
                                      size_t output_length);
 FREERDP_LOCAL BOOL security_mac_signature(rdpRdp* rdp, const BYTE* data, UINT32 length,
                                           BYTE* output, size_t out_len);