commit b4e3e694e80bf59bbdc202c9a626e6ecb272c9b1
author Brian Smith <brian@briansmith.org> Wed Feb 24 09:58:18 2016 -1000
committer Adam Langley <agl@google.com> Fri Feb 26 01:02:40 2016 +0000
tree 80ac855aaba36aca7121fb5d7848efb03a42984a
parent 6234a7f3a706d2f863e949b4d360ff07faba9dbd

Use correct counter after invoking stitched AES-NI GCM code.

Commit a3d9528e9e212e0dcda30dcb561092c3b3a69010 has a bug that could
cause counters to be reused if |$avx=2| were set in the AES-NI AES-GCM
assembly code, if the EVP interface were used with certain coding
patterns, as demonstrated by the test cases added in
a5ee83f67e83d4065d1aa40137e8dd8b1c83b3e5.

This changes the encryption code in the same way the decryption code
was changed in a3d9528e9e212e0dcda30dcb561092c3b3a69010.

This doesn't have any effect currently since the AES-NI AES-GCM code
has |$avx=0| now, so |aesni_gcm_encrypt| doesn't change the counter.

Change-Id: Iba69cb4d2043d1ea57c6538b398246af28cba006
Reviewed-on: https://boringssl-review.googlesource.com/7193
Reviewed-by: Adam Langley <agl@google.com>

crypto/modes/gcm.c

diff --git a/crypto/modes/gcm.c b/crypto/modes/gcm.c
index 153ff17..fe1556d 100644
--- a/crypto/modes/gcm.c
+++ b/crypto/modes/gcm.c
@@ -1003,12 +1003,6 @@
     ctx->ares = 0;
   }
 
-  if (is_endian.little) {
-    ctr = GETU32(ctx->Yi.c + 12);
-  } else {
-    ctr = ctx->Yi.d[3];
-  }
-
   n = ctx->mres;
   if (n) {
     while (n && len) {
@@ -1035,6 +1029,12 @@
   }
 #endif
 
+  if (is_endian.little) {
+    ctr = GETU32(ctx->Yi.c + 12);
+  } else {
+    ctr = ctx->Yi.d[3];
+  }
+
 #if defined(GHASH)
   while (len >= GHASH_CHUNK) {
     (*stream)(in, out, GHASH_CHUNK / 16, key, ctx->Yi.c);