Fix limits for AES-GCM-SIV.

We can't have the counter wrap, so the limit is 2^32 AES blocks, or
2^36 bytes.

The openv path has previously allowed for an extra block; this was
wrong, as in our code, the tag is considered separate.

Change-Id: I730028350e86aadda826b4c55f15e7326a6a6964
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/95930
Commit-Queue: Rudolf Polzer <rpolzer@google.com>
Reviewed-by: David Benjamin <davidben@google.com>

crypto/cipher/e_aesgcmsiv.cc

diff --git a/crypto/cipher/e_aesgcmsiv.cc b/crypto/cipher/e_aesgcmsiv.cc
index 8ee9c68..781719f 100644
--- a/crypto/cipher/e_aesgcmsiv.cc
+++ b/crypto/cipher/e_aesgcmsiv.cc
@@ -972,7 +972,7 @@
 
   const uint64_t in_len_64 = bssl::iovec::TotalLength(iovecs);
   if (in_tag.size() != EVP_AEAD_AES_GCM_SIV_TAG_LEN ||
-      in_len_64 > (UINT64_C(1) << 36) + AES_BLOCK_SIZE) {
+      in_len_64 > (UINT64_C(1) << 36)) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
     return 0;
   }