authorgravatar for 33079554+naoki9911@users.noreply.github.comNaoki MATSUMOTO <33079554+naoki9911@users.noreply.github.com> 2022-11-15 00:35:08+09:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2022-11-14 16:35:08+01:00
logb29057b6ab78eda87e4f3c9007dc110c101e8e35
treee6d4fe7379d007ffad27c7ea7244d484e630fdc1
parent0b0292c4565ebe6267f53d8edcd5fd41270348bb
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

std.crypto.ghash: fix uninitialized polynomial use (#13527)

In the process of 'remaining blocks', the length of processed message can be from 1 to 79. The value of 'n-1' is ranged from 0 to 3. So, st.hx[i] must be initialized at least from st.hx[0] to st.hx[3]

1 files changed, 5 insertions(+), 8 deletions(-)

lib/std/crypto/ghash.zig+5-8
......@@ -18,7 +18,7 @@ pub const Ghash = struct {
1818 pub const mac_length = 16;
1919 pub const key_length = 16;
2020
21 const pc_count = if (builtin.mode != .ReleaseSmall) 16 else 2;
21 const pc_count = if (builtin.mode != .ReleaseSmall) 16 else 4;
2222 const agg_2_treshold = 5;
2323 const agg_4_treshold = 22;
2424 const agg_8_treshold = 84;
......@@ -42,14 +42,11 @@ pub const Ghash = struct {
4242
4343 var hx: [pc_count]Precomp = undefined;
4444 hx[0] = h;
45 if (block_count >= agg_2_treshold) {
46 hx[1] = gcmReduce(clsq128(hx[0])); // h^2
47 }
45 hx[1] = gcmReduce(clsq128(hx[0])); // h^2
46 hx[2] = gcmReduce(clmul128(hx[1], h)); // h^3
47 hx[3] = gcmReduce(clsq128(hx[1])); // h^4 = h^2^2
48
4849 if (builtin.mode != .ReleaseSmall) {
49 if (block_count >= agg_4_treshold) {
50 hx[2] = gcmReduce(clmul128(hx[1], h)); // h^3
51 hx[3] = gcmReduce(clsq128(hx[1])); // h^4 = h^2^2
52 }
5350 if (block_count >= agg_8_treshold) {
5451 hx[4] = gcmReduce(clmul128(hx[3], h)); // h^5
5552 hx[5] = gcmReduce(clsq128(hx[2])); // h^6 = h^3^2