Commit 1d7a8dd73f for openssl.org

commit 1d7a8dd73ff9e0fc197611433b9b60b4b5f5465c
Author: Kurt Roeckx <kurt@roeckx.be>
Date:   Tue Jul 14 19:40:42 2026 +0200

    Add value_barrier in BN_consttime_swap

    Without it, compilers can figure out the possible values and optimize
    based on it.

    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    MergeDate: Wed Jul 29 17:04:47 2026
    (Merged from https://github.com/openssl/openssl/pull/31957)

diff --git a/crypto/bn/bn_lib.c b/crypto/bn/bn_lib.c
index a63e2b9154..226c0c615c 100644
--- a/crypto/bn/bn_lib.c
+++ b/crypto/bn/bn_lib.c
@@ -955,11 +955,11 @@ void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)

     condition = ((~condition & ((condition - 1))) >> (BN_BITS2 - 1)) - 1;

-    t = (a->top ^ b->top) & condition;
+    t = (a->top ^ b->top) & value_barrier_bn(condition);
     a->top ^= t;
     b->top ^= t;

-    t = (a->neg ^ b->neg) & condition;
+    t = (a->neg ^ b->neg) & value_barrier_bn(condition);
     a->neg ^= t;
     b->neg ^= t;

@@ -987,13 +987,13 @@ void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)

 #define BN_CONSTTIME_SWAP_FLAGS (BN_FLG_CONSTTIME | BN_FLG_FIXED_TOP)

-    t = ((a->flags ^ b->flags) & BN_CONSTTIME_SWAP_FLAGS) & condition;
+    t = ((a->flags ^ b->flags) & BN_CONSTTIME_SWAP_FLAGS) & value_barrier_bn(condition);
     a->flags ^= t;
     b->flags ^= t;

     /* conditionally swap the data */
     for (i = 0; i < nwords; i++) {
-        t = (a->d[i] ^ b->d[i]) & condition;
+        t = (a->d[i] ^ b->d[i]) & value_barrier_bn(condition);
         a->d[i] ^= t;
         b->d[i] ^= t;
     }