fixes #4477 (libsodium: update to 1.0.20)

3 files changed, 41 insertions, 34 deletions

diff --git a/libs/libsodium/src/crypto_onetimeauth/poly1305/donna/poly1305_donna32.h b/libs/libsodium/src/crypto_onetimeauth/poly1305/donna/poly1305_donna32.h
index f6d62e53b9..b2ce5679d3 100644
--- a/libs/libsodium/src/crypto_onetimeauth/poly1305/donna/poly1305_donna32.h
+++ b/libs/libsodium/src/crypto_onetimeauth/poly1305/donna/poly1305_donna32.h
@@ -122,7 +122,7 @@ poly1305_blocks(poly1305_state_internal_t *st, const unsigned char *m,
         h4 = (unsigned long) d4 & 0x3ffffff;

         h0 += c * 5;

         c  = (h0 >> 26);

-        h0 = h0 & 0x3ffffff;

+        h0 &= 0x3ffffff;

         h1 += c;

 

         m += poly1305_block_size;

diff --git a/libs/libsodium/src/crypto_onetimeauth/poly1305/donna/poly1305_donna64.h b/libs/libsodium/src/crypto_onetimeauth/poly1305/donna/poly1305_donna64.h
index ae79f637e0..160e6e4ace 100644
--- a/libs/libsodium/src/crypto_onetimeauth/poly1305/donna/poly1305_donna64.h
+++ b/libs/libsodium/src/crypto_onetimeauth/poly1305/donna/poly1305_donna64.h
@@ -41,7 +41,7 @@ poly1305_init(poly1305_state_internal_t *st, const unsigned char key[32])
     t1 = LOAD64_LE(&key[8]);

 

     /* wiped after finalization */

-    st->r[0] = (t0) &0xffc0fffffff;

+    st->r[0] = (t0) & 0xffc0fffffff;

     st->r[1] = ((t0 >> 44) | (t1 << 20)) & 0xfffffc0ffff;

     st->r[2] = ((t1 >> 24)) & 0x00ffffffc0f;

 

@@ -88,8 +88,8 @@ poly1305_blocks(poly1305_state_internal_t *st, const unsigned char *m,
         t0 = LOAD64_LE(&m[0]);

         t1 = LOAD64_LE(&m[8]);

 

-        h0 += ((t0) &0xfffffffffff);

-        h1 += (((t0 >> 44) | (t1 << 20)) & 0xfffffffffff);

+        h0 += t0 & 0xfffffffffff;

+        h1 += ((t0 >> 44) | (t1 << 20)) & 0xfffffffffff;

         h2 += (((t1 >> 24)) & 0x3ffffffffff) | hibit;

 

         /* h *= r */

@@ -120,7 +120,7 @@ poly1305_blocks(poly1305_state_internal_t *st, const unsigned char *m,
         h2 = LO(d2) & 0x3ffffffffff;

         h0 += c * 5;

         c  = (h0 >> 44);

-        h0 = h0 & 0xfffffffffff;

+        h0 &= 0xfffffffffff;

         h1 += c;

 

         m += poly1305_block_size;

@@ -138,6 +138,7 @@ poly1305_finish(poly1305_state_internal_t *st, unsigned char mac[16])
     unsigned long long h0, h1, h2, c;

     unsigned long long g0, g1, g2;

     unsigned long long t0, t1;

+    unsigned long long mask;

 

     /* process the remaining block */

     if (st->leftover) {

@@ -157,49 +158,49 @@ poly1305_finish(poly1305_state_internal_t *st, unsigned char mac[16])
     h1 = st->h[1];

     h2 = st->h[2];

 

-    c = (h1 >> 44);

+    c = h1 >> 44;

     h1 &= 0xfffffffffff;

     h2 += c;

-    c = (h2 >> 42);

+    c = h2 >> 42;

     h2 &= 0x3ffffffffff;

     h0 += c * 5;

-    c = (h0 >> 44);

+    c = h0 >> 44;

     h0 &= 0xfffffffffff;

     h1 += c;

-    c = (h1 >> 44);

+    c = h1 >> 44;

     h1 &= 0xfffffffffff;

     h2 += c;

-    c = (h2 >> 42);

+    c = h2 >> 42;

     h2 &= 0x3ffffffffff;

     h0 += c * 5;

-    c = (h0 >> 44);

+    c = h0 >> 44;

     h0 &= 0xfffffffffff;

     h1 += c;

 

     /* compute h + -p */

     g0 = h0 + 5;

-    c  = (g0 >> 44);

+    c  = g0 >> 44;

     g0 &= 0xfffffffffff;

     g1 = h1 + c;

-    c  = (g1 >> 44);

+    c  = g1 >> 44;

     g1 &= 0xfffffffffff;

     g2 = h2 + c - (1ULL << 42);

 

     /* select h if h < p, or h + -p if h >= p */

-    c = (g2 >> ((sizeof(unsigned long long) * 8) - 1)) - 1;

-    g0 &= c;

-    g1 &= c;

-    g2 &= c;

-    c  = ~c;

-    h0 = (h0 & c) | g0;

-    h1 = (h1 & c) | g1;

-    h2 = (h2 & c) | g2;

+    mask = (g2 >> ((sizeof(unsigned long long) * 8) - 1)) - 1;

+    g0   &= mask;

+    g1   &= mask;

+    g2   &= mask;

+    mask =  ~mask;

+    h0   =  (h0 & mask) | g0;

+    h1   =  (h1 & mask) | g1;

+    h2   =  (h2 & mask) | g2;

 

     /* h = (h + pad) */

     t0 = st->pad[0];

     t1 = st->pad[1];

 

-    h0 += ((t0) &0xfffffffffff);

+    h0 += ((t0) & 0xfffffffffff);

     c = (h0 >> 44);

     h0 &= 0xfffffffffff;

     h1 += (((t0 >> 44) | (t1 << 20)) & 0xfffffffffff) + c;

@@ -209,8 +210,8 @@ poly1305_finish(poly1305_state_internal_t *st, unsigned char mac[16])
     h2 &= 0x3ffffffffff;

 

     /* mac = h % (2^128) */

-    h0 = ((h0) | (h1 << 44));

-    h1 = ((h1 >> 20) | (h2 << 24));

+    h0 = (h0) | (h1 << 44);

+    h1 = (h1 >> 20) | (h2 << 24);

 

     STORE64_LE(&mac[0], h0);

     STORE64_LE(&mac[8], h1);

diff --git a/libs/libsodium/src/crypto_onetimeauth/poly1305/sse2/poly1305_sse2.c b/libs/libsodium/src/crypto_onetimeauth/poly1305/sse2/poly1305_sse2.c
index 77b3862026..53e7c34f43 100644
--- a/libs/libsodium/src/crypto_onetimeauth/poly1305/sse2/poly1305_sse2.c
+++ b/libs/libsodium/src/crypto_onetimeauth/poly1305/sse2/poly1305_sse2.c
@@ -6,16 +6,18 @@
 #include "crypto_verify_16.h"

 #include "poly1305_sse2.h"

 #include "private/common.h"

-#include "private/sse2_64_32.h"

 #include "utils.h"

 

 #if defined(HAVE_TI_MODE) && defined(HAVE_EMMINTRIN_H)

 

-# ifdef __GNUC__

+# ifdef __clang__

+#  pragma clang attribute push(__attribute__((target("sse2"))), apply_to = function)

+# elif defined(__GNUC__)

 #  pragma GCC target("sse2")

 # endif

 

 # include <emmintrin.h>

+# include "private/sse2_64_32.h"

 

 typedef __m128i xmmi;

 

@@ -41,14 +43,14 @@ typedef struct poly1305_state_internal_t {
     union {

         uint64_t h[3];

         uint32_t hh[10];

-    } H;                                            /*  40 bytes  */

-    uint32_t           R[5];                        /*  20 bytes  */

-    uint32_t           R2[5];                       /*  20 bytes  */

-    uint32_t           R4[5];                       /*  20 bytes  */

-    uint64_t           pad[2];                      /*  16 bytes  */

-    uint64_t           flags;                       /*   8 bytes  */

-    unsigned long long leftover;                    /* 8 bytes */

-    unsigned char      buffer[poly1305_block_size]; /* 32 bytes */

+    } H;                                            /*  40 bytes */

+    uint32_t           R[5];                        /*  20 bytes */

+    uint32_t           R2[5];                       /*  20 bytes */

+    uint32_t           R4[5];                       /*  20 bytes */

+    uint64_t           pad[2];                      /*  16 bytes */

+    uint64_t           flags;                       /*   8 bytes */

+    unsigned long long leftover;                    /*   8 bytes */

+    unsigned char      buffer[poly1305_block_size]; /*  32 bytes */

 } poly1305_state_internal_t;                        /* 164 bytes total */

 

 /*

@@ -946,4 +948,8 @@ struct crypto_onetimeauth_poly1305_implementation
         SODIUM_C99(.onetimeauth_final =) crypto_onetimeauth_poly1305_sse2_final

     };

 

+#ifdef __clang__

+# pragma clang attribute pop

+#endif

+

 #endif