check length sanity before correcting in EVP_CTRL_AEAD_TLS1_AAD