Upgrade chrome's OpenSSL to same version Android ships with.

openssl/crypto/ec/ec2_mult.c

 /* crypto/ec/ec2_mult.c */
 /* ====================================================================
  * Copyright 2002 Sun Microsystems, Inc. ALL RIGHTS RESERVED.
  *
  * The Elliptic Curve Public-Key Crypto Library (ECC Code) included
  * herein is developed by SUN MICROSYSTEMS, INC., and is contributed
  * to the OpenSSL project.
  *
  * The ECC Code is licensed pursuant to the OpenSSL open source
  * license provided below.
@@ skipping 58 matching lines @@
 
 #include <openssl/err.h>
 
 #include "ec_lcl.h"
 
 
 /* Compute the x-coordinate x/z for the point 2*(x/z) in Montgomery projective 
  * coordinates.
  * Uses algorithm Mdouble in appendix of 
  *     Lopez, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
- *     GF(2^m) without precomputation".
+ *     GF(2^m) without precomputation" (CHES '99, LNCS 1717).
  * modified to not require precomputation of c=b^{2^{m-1}}.
  */
 static int gf2m_Mdouble(const EC_GROUP *group, BIGNUM *x, BIGNUM *z, BN_CTX *ctx)
         {
         BIGNUM *t1;
         int ret = 0;
         
         /* Since Mdouble is static we can guarantee that ctx != NULL. */
         BN_CTX_start(ctx);
         t1 = BN_CTX_get(ctx);
@@ skipping 10 matching lines @@
         ret = 1;
 
  err:
         BN_CTX_end(ctx);
         return ret;
         }
 
 /* Compute the x-coordinate x1/z1 for the point (x1/z1)+(x2/x2) in Montgomery 
  * projective coordinates.
  * Uses algorithm Madd in appendix of 
- *     Lopex, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
- *     GF(2^m) without precomputation".
+ *     Lopez, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
+ *     GF(2^m) without precomputation" (CHES '99, LNCS 1717).
  */
 static int gf2m_Madd(const EC_GROUP *group, const BIGNUM *x, BIGNUM *x1, BIGNUM *z1, 
         const BIGNUM *x2, const BIGNUM *z2, BN_CTX *ctx)
         {
         BIGNUM *t1, *t2;
         int ret = 0;
         
         /* Since Madd is static we can guarantee that ctx != NULL. */
         BN_CTX_start(ctx);
         t1 = BN_CTX_get(ctx);
@@ skipping 11 matching lines @@
 
         ret = 1;
 
  err:
         BN_CTX_end(ctx);
         return ret;
         }
 
 /* Compute the x, y affine coordinates from the point (x1, z1) (x2, z2) 
  * using Montgomery point multiplication algorithm Mxy() in appendix of 
- *     Lopex, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
- *     GF(2^m) without precomputation".
+ *     Lopez, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
+ *     GF(2^m) without precomputation" (CHES '99, LNCS 1717).
  * Returns:
  *     0 on error
  *     1 if return value should be the point at infinity
  *     2 otherwise
  */
 static int gf2m_Mxy(const EC_GROUP *group, const BIGNUM *x, const BIGNUM *y, BIGNUM *x1, 
         BIGNUM *z1, BIGNUM *x2, BIGNUM *z2, BN_CTX *ctx)
         {
         BIGNUM *t3, *t4, *t5;
         int ret = 0;
@@ skipping 47 matching lines @@
         ret = 2;
 
  err:
         BN_CTX_end(ctx);
         return ret;
         }
 
 /* Computes scalar*point and stores the result in r.
  * point can not equal r.
  * Uses algorithm 2P of
- *     Lopex, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
- *     GF(2^m) without precomputation".
+ *     Lopez, J. and Dahab, R.  "Fast multiplication on elliptic curves over 
+ *     GF(2^m) without precomputation" (CHES '99, LNCS 1717).
  */
 static int ec_GF2m_montgomery_point_multiply(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
         const EC_POINT *point, BN_CTX *ctx)
         {
         BIGNUM *x1, *x2, *z1, *z2;
-        int ret = 0, i, j;
-        BN_ULONG mask;
+        int ret = 0, i;
+        BN_ULONG mask,word;
 
         if (r == point)
                 {
                 ECerr(EC_F_EC_GF2M_MONTGOMERY_POINT_MULTIPLY, EC_R_INVALID_ARGUMENT);
                 return 0;
                 }
         
         /* if result should be point at infinity */
         if ((scalar == NULL) || BN_is_zero(scalar) || (point == NULL) || 
                 EC_POINT_is_at_infinity(group, point))
@@ skipping 13 matching lines @@
         x2 = &r->X;
         z2 = &r->Y;
 
         if (!BN_GF2m_mod_arr(x1, &point->X, group->poly)) goto err; /* x1 = x */
         if (!BN_one(z1)) goto err; /* z1 = 1 */
         if (!group->meth->field_sqr(group, z2, x1, ctx)) goto err; /* z2 = x1^2 = x^2 */
         if (!group->meth->field_sqr(group, x2, z2, ctx)) goto err;
         if (!BN_GF2m_add(x2, x2, &group->b)) goto err; /* x2 = x^4 + b */
 
         /* find top most bit and go one past it */
-        i = scalar->top - 1; j = BN_BITS2 - 1;
+        i = scalar->top - 1;
         mask = BN_TBIT;
-        while (!(scalar->d[i] & mask)) { mask >>= 1; j--; }
-        mask >>= 1; j--;
+        word = scalar->d[i];
+        while (!(word & mask)) mask >>= 1;
+        mask >>= 1;
         /* if top most bit was at word break, go to next word */
         if (!mask) 
                 {
-                i--; j = BN_BITS2 - 1;
+                i--;
                 mask = BN_TBIT;
                 }
 
         for (; i >= 0; i--)
                 {
-                for (; j >= 0; j--)
+                word = scalar->d[i];
+                while (mask)
                         {
-                        if (scalar->d[i] & mask)
+                        if (word & mask)
                                 {
                                 if (!gf2m_Madd(group, &point->X, x1, z1, x2, z2, ctx)) goto err;
                                 if (!gf2m_Mdouble(group, x2, z2, ctx)) goto err;
                                 }
                         else
                                 {
                                 if (!gf2m_Madd(group, &point->X, x2, z2, x1, z1, ctx)) goto err;
                                 if (!gf2m_Mdouble(group, x1, z1, ctx)) goto err;
                                 }
                         mask >>= 1;
                         }
-                j = BN_BITS2 - 1;
                 mask = BN_TBIT;
                 }
 
         /* convert out of "projective" coordinates */
         i = gf2m_Mxy(group, &point->X, &point->Y, x1, z1, x2, z2, ctx);
         if (i == 0) goto err;
         else if (i == 1) 
                 {
                 if (!EC_POINT_set_to_infinity(group, r)) goto err;
                 }
@@ skipping 19 matching lines @@
  *     scalar*group->generator + scalars[0]*points[0] + ... + scalars[num-1]*points[num-1]
  * gracefully ignoring NULL scalar values.
  */
 int ec_GF2m_simple_mul(const EC_GROUP *group, EC_POINT *r, const BIGNUM *scalar,
         size_t num, const EC_POINT *points[], const BIGNUM *scalars[], BN_CTX *ctx)
         {
         BN_CTX *new_ctx = NULL;
         int ret = 0;
         size_t i;
         EC_POINT *p=NULL;
+        EC_POINT *acc = NULL;
 
         if (ctx == NULL)
                 {
                 ctx = new_ctx = BN_CTX_new();
                 if (ctx == NULL)
                         return 0;
                 }
 
         /* This implementation is more efficient than the wNAF implementation for 2
          * or fewer points.  Use the ec_wNAF_mul implementation for 3 or more points,
          * or if we can perform a fast multiplication based on precomputation.
          */
         if ((scalar && (num > 1)) || (num > 2) || (num == 0 && EC_GROUP_have_precompute_mult(group)))
                 {
                 ret = ec_wNAF_mul(group, r, scalar, num, points, scalars, ctx);
                 goto err;
                 }
 
         if ((p = EC_POINT_new(group)) == NULL) goto err;
+        if ((acc = EC_POINT_new(group)) == NULL) goto err;
 
-        if (!EC_POINT_set_to_infinity(group, r)) goto err;
+        if (!EC_POINT_set_to_infinity(group, acc)) goto err;
 
         if (scalar)
                 {
                 if (!ec_GF2m_montgomery_point_multiply(group, p, scalar, group->generator, ctx)) goto err;
-                if (BN_is_negative(scalar)) 
+                if (BN_is_negative(scalar))
                         if (!group->meth->invert(group, p, ctx)) goto err;
-                if (!group->meth->add(group, r, r, p, ctx)) goto err;
+                if (!group->meth->add(group, acc, acc, p, ctx)) goto err;
                 }
 
         for (i = 0; i < num; i++)
                 {
                 if (!ec_GF2m_montgomery_point_multiply(group, p, scalars[i], points[i], ctx)) goto err;
                 if (BN_is_negative(scalars[i]))
                         if (!group->meth->invert(group, p, ctx)) goto err;
-                if (!group->meth->add(group, r, r, p, ctx)) goto err;
+                if (!group->meth->add(group, acc, acc, p, ctx)) goto err;
                 }
 
+        if (!EC_POINT_copy(r, acc)) goto err;
+
         ret = 1;
 
   err:
         if (p) EC_POINT_free(p);
+        if (acc) EC_POINT_free(acc);
         if (new_ctx != NULL)
                 BN_CTX_free(new_ctx);
         return ret;
         }
 
 
 /* Precomputation for point multiplication: fall back to wNAF methods
  * because ec_GF2m_simple_mul() uses ec_wNAF_mul() if appropriate */
 
 int ec_GF2m_precompute_mult(EC_GROUP *group, BN_CTX *ctx)
         {
         return ec_wNAF_precompute_mult(group, ctx);
         }
 
 int ec_GF2m_have_precompute_mult(const EC_GROUP *group)
         {
         return ec_wNAF_have_precompute_mult(group);
         }