authorgravatar for 33079554+naoki9911@users.noreply.github.comNaoki MATSUMOTO <33079554+naoki9911@users.noreply.github.com> 2022-11-15 00:35:08+09:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2022-11-14 16:35:08+01:00
logb29057b6ab78eda87e4f3c9007dc110c101e8e35
treee6d4fe7379d007ffad27c7ea7244d484e630fdc1
parent0b0292c4565ebe6267f53d8edcd5fd41270348bb
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

std.crypto.ghash: fix uninitialized polynomial use (#13527)

In the process of 'remaining blocks', the length of processed message can be from 1 to 79. The value of 'n-1' is ranged from 0 to 3. So, st.hx[i] must be initialized at least from st.hx[0] to st.hx[3]

1 files changed, 5 insertions(+), 8 deletions(-)

lib/std/crypto/ghash.zig+5-8
...@@ -18,7 +18,7 @@ pub const Ghash = struct {...@@ -18,7 +18,7 @@ pub const Ghash = struct {
18 pub const mac_length = 16;18 pub const mac_length = 16;
19 pub const key_length = 16;19 pub const key_length = 16;
2020
21 const pc_count = if (builtin.mode != .ReleaseSmall) 16 else 2;21 const pc_count = if (builtin.mode != .ReleaseSmall) 16 else 4;
22 const agg_2_treshold = 5;22 const agg_2_treshold = 5;
23 const agg_4_treshold = 22;23 const agg_4_treshold = 22;
24 const agg_8_treshold = 84;24 const agg_8_treshold = 84;
...@@ -42,14 +42,11 @@ pub const Ghash = struct {...@@ -42,14 +42,11 @@ pub const Ghash = struct {
4242
43 var hx: [pc_count]Precomp = undefined;43 var hx: [pc_count]Precomp = undefined;
44 hx[0] = h;44 hx[0] = h;
45 if (block_count >= agg_2_treshold) {45 hx[1] = gcmReduce(clsq128(hx[0])); // h^2
46 hx[1] = gcmReduce(clsq128(hx[0])); // h^246 hx[2] = gcmReduce(clmul128(hx[1], h)); // h^3
47 }47 hx[3] = gcmReduce(clsq128(hx[1])); // h^4 = h^2^2
48
48 if (builtin.mode != .ReleaseSmall) {49 if (builtin.mode != .ReleaseSmall) {
49 if (block_count >= agg_4_treshold) {
50 hx[2] = gcmReduce(clmul128(hx[1], h)); // h^3
51 hx[3] = gcmReduce(clsq128(hx[1])); // h^4 = h^2^2
52 }
53 if (block_count >= agg_8_treshold) {50 if (block_count >= agg_8_treshold) {
54 hx[4] = gcmReduce(clmul128(hx[3], h)); // h^551 hx[4] = gcmReduce(clmul128(hx[3], h)); // h^5
55 hx[5] = gcmReduce(clsq128(hx[2])); // h^6 = h^3^252 hx[5] = gcmReduce(clsq128(hx[2])); // h^6 = h^3^2