some ciphers (e.g., block cipher) might return less amount output than input
diff --git a/include/picotls.h b/include/picotls.h
index b0290cb..9292414 100644
--- a/include/picotls.h
+++ b/include/picotls.h
@@ -1551,10 +1551,8 @@
     uint8_t *output = _output;
 
     ctx->do_encrypt_init(ctx, seq, aad, aadlen);
-    for (size_t i = 0; i < incnt; ++i) {
-        ctx->do_encrypt_update(ctx, output, input[i].base, input[i].len);
-        output += input[i].len;
-    }
+    for (size_t i = 0; i < incnt; ++i)
+        output += ctx->do_encrypt_update(ctx, output, input[i].base, input[i].len);
     ctx->do_encrypt_final(ctx, output);
 }