sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-03 00:00:24 -04:00
Code Issues Projects Releases Wiki Activity

sha3: Fix Keccak when compiled with GCC 13.x

Browse Source 
With GCC 13, the compiler apparently applies new aliasing optimizations
when compiled with -O2 and without -fno-strict-aliasing.  This caused
the application of the second padding bit, where the state was accessed
via uint8_t[], to be moved before the loop that absorbs the buffer into
the state, where the state is accessed via uint64_t[], resulting in
incorrect output.  By only accessing the state via uint64_t[] here the
compiler won't reorder the instructions.
This commit is contained in:
Tobias Brunner 2024-03-28 11:51:15 +01:00
parent ac713746c9
commit 56f4b2096a
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/libstrongswan/plugins/sha3/sha3_keccak.c
View File

@ -372,7 +372,6 @@ METHOD(sha3_keccak_t, reset, void,
this->rate_index = 0;
}
METHOD(sha3_keccak_t, absorb, void,
private_sha3_keccak_t *this, chunk_t data)
{
@ -431,8 +430,12 @@ METHOD(sha3_keccak_t, finalize, void,
state_lanes[i] ^= buffer_lanes[i];
}
/* Add the second bit of padding */
this->state[this->rate - 1] ^= 0x80;
/* Add the second bit of padding, do this consistently via state_lanes[] and
* not state[] to avoid that the compiler reorders this due to aliasing
* optimizations */
rate_lanes = (this->rate - 1) / sizeof(uint64_t);
remainder = (this->rate - 1) % sizeof(uint64_t);
state_lanes[rate_lanes] ^= (0x80ULL << remainder * 8);
/* Switch to the squeezing phase */
keccak_f1600_state_permute(this->state);