diff --git a/src/share/classes/sun/security/pkcs11/P11Cipher.java b/src/share/classes/sun/security/pkcs11/P11Cipher.java
--- openjdk/jdk/src/share/classes/sun/security/pkcs11/P11Cipher.java
+++ openjdk/jdk/src/share/classes/sun/security/pkcs11/P11Cipher.java
@@ -560,7 +560,8 @@
         }
         try {
             ensureInitialized();
-            int k = 0;
+            int bufRes = 0;
+	    int inRes = 0;
 	    int newBlockBufferLen = 0;
 
 	    // NSS throws up when called with data not in multiple
@@ -579,21 +580,21 @@
 		    }
 		}
 		if (encrypt) {
-		    k = token.p11.C_EncryptUpdate(session.id(), 0, blockBuffer, 0,
-						  blockBufferLen, 0, out, outOfs,
-						  outLen);
+		    bufRes = token.p11.C_EncryptUpdate(session.id(), 0, blockBuffer, 0,
+						       blockBufferLen, 0, out, outOfs,
+						       outLen);
 		} else {
-		    k = token.p11.C_DecryptUpdate(session.id(), 0, blockBuffer, 0,
-						  blockBufferLen, 0, out, outOfs,
-						  outLen);
+		    bufRes = token.p11.C_DecryptUpdate(session.id(), 0, blockBuffer, 0,
+						       blockBufferLen, 0, out, outOfs,
+						       outLen);
 		}
-		bytesBufferedInt += (blockBufferLen - k);
+		bytesBufferedInt += (blockBufferLen - bufRes);
 		blockBufferLen = 0;
 		bytesBuffered = 0;
 	    }
 
 	    if (inLen == 0)
-		return k;
+		return bufRes;
 
 	    if (blockBuffer != null) {
 		newBlockBufferLen = inLen & (blockSize - 1);
@@ -606,16 +607,18 @@
 
 	    if (inLen > 0) {
 		if (encrypt) {
-                    k = token.p11.C_EncryptUpdate(session.id(), 0, in, inOfs,
-                            inLen, 0, out, (outOfs + k), (outLen - k));
+                    inRes = token.p11.C_EncryptUpdate(session.id(), 0, in, inOfs,
+						      inLen, 0, out, (outOfs + bufRes),
+						      (outLen - bufRes));
 		} else {
-                    k = token.p11.C_DecryptUpdate(session.id(), 0, in, inOfs,
-                            inLen, 0, out, (outOfs + k), (outLen - k));
+                    inRes = token.p11.C_DecryptUpdate(session.id(), 0, in, inOfs,
+						      inLen, 0, out, (outOfs + bufRes),
+						      (outLen - bufRes));
 		}
-		bytesBufferedInt += (inLen - k);
+		bytesBufferedInt += (inLen - inRes);
 	    }
 
-            return k;
+            return inRes + bufRes;
         } catch (PKCS11Exception e) {
             if (e.getErrorCode() == CKR_BUFFER_TOO_SMALL) {
                 throw (ShortBufferException)
@@ -668,7 +671,8 @@
                 }
             }
 
-            int k = 0;
+            int bufRes = 0;
+	    int inRes = 0;
 	    int newBlockBufferLen = 0;
 
 	    // NSS throws up when called with data not in multiple
@@ -687,21 +691,21 @@
 		    }
 		}
 		if (encrypt) {
-		    k = token.p11.C_EncryptUpdate(session.id(), 0, blockBuffer, 0,
-						  blockBufferLen, outAddr, outArray, outOfs,
-						  outLen);
+		    bufRes = token.p11.C_EncryptUpdate(session.id(), 0, blockBuffer, 0,
+						       blockBufferLen, outAddr, outArray, outOfs,
+						       outLen);
 		} else {
-		    k = token.p11.C_DecryptUpdate(session.id(), 0, blockBuffer, 0,
-						  blockBufferLen, outAddr, outArray, outOfs,
-						  outLen);
+		    bufRes = token.p11.C_DecryptUpdate(session.id(), 0, blockBuffer, 0,
+						       blockBufferLen, outAddr, outArray, outOfs,
+						       outLen);
 		}
-		bytesBufferedInt += (blockBufferLen - k);
+		bytesBufferedInt += (blockBufferLen - bufRes);
 		blockBufferLen = 0;
 		bytesBuffered = 0;
 	    }
 
 	    if (inLen == 0)
-		return k;
+		return bufRes;
 
 	    if (blockBuffer != null) {
 		newBlockBufferLen = inLen & (blockSize - 1);
@@ -721,22 +725,25 @@
 
 	    if (inLen > 0) {
 		if (encrypt) {
-                    k = token.p11.C_EncryptUpdate(session.id(), inAddr, inArray, inOfs,
-                            inLen, outAddr, outArray, (outOfs + k), (outLen - k));
+                    inRes = token.p11.C_EncryptUpdate(session.id(), inAddr, inArray, inOfs,
+						      inLen, outAddr, outArray, (outOfs + bufRes),
+						      (outLen - bufRes));
 		} else {
-                    k = token.p11.C_DecryptUpdate(session.id(), inAddr, inArray, inOfs,
-                            inLen, outAddr, outArray, (outOfs + k), (outLen - k));
+                    inRes = token.p11.C_DecryptUpdate(session.id(), inAddr, inArray, inOfs,
+						      inLen, outAddr, outArray, (outOfs + bufRes),
+						      (outLen - bufRes));
 		}
-		bytesBufferedInt += (inLen - k);
+		bytesBufferedInt += (inLen - inRes);
 	    }
 
+	    int total = inRes + bufRes;
             if (!(outBuffer instanceof DirectBuffer) &&
                     !outBuffer.hasArray()) {
-                outBuffer.put(outArray, outOfs, k);
+                outBuffer.put(outArray, outOfs, total);
             } else {
-                outBuffer.position(outBuffer.position() + k);
+                outBuffer.position(outBuffer.position() + total);
             }
-            return k;
+	    return total;
         } catch (PKCS11Exception e) {
             // Reset input buffer to its original position for
             inBuffer.position(origPos);