Commit 1d7a8dd73f for openssl.org
commit 1d7a8dd73ff9e0fc197611433b9b60b4b5f5465c
Author: Kurt Roeckx <kurt@roeckx.be>
Date: Tue Jul 14 19:40:42 2026 +0200
Add value_barrier in BN_consttime_swap
Without it, compilers can figure out the possible values and optimize
based on it.
Reviewed-by: Andrew Dinh <andrewd@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Wed Jul 29 17:04:47 2026
(Merged from https://github.com/openssl/openssl/pull/31957)
diff --git a/crypto/bn/bn_lib.c b/crypto/bn/bn_lib.c
index a63e2b9154..226c0c615c 100644
--- a/crypto/bn/bn_lib.c
+++ b/crypto/bn/bn_lib.c
@@ -955,11 +955,11 @@ void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
condition = ((~condition & ((condition - 1))) >> (BN_BITS2 - 1)) - 1;
- t = (a->top ^ b->top) & condition;
+ t = (a->top ^ b->top) & value_barrier_bn(condition);
a->top ^= t;
b->top ^= t;
- t = (a->neg ^ b->neg) & condition;
+ t = (a->neg ^ b->neg) & value_barrier_bn(condition);
a->neg ^= t;
b->neg ^= t;
@@ -987,13 +987,13 @@ void BN_consttime_swap(BN_ULONG condition, BIGNUM *a, BIGNUM *b, int nwords)
#define BN_CONSTTIME_SWAP_FLAGS (BN_FLG_CONSTTIME | BN_FLG_FIXED_TOP)
- t = ((a->flags ^ b->flags) & BN_CONSTTIME_SWAP_FLAGS) & condition;
+ t = ((a->flags ^ b->flags) & BN_CONSTTIME_SWAP_FLAGS) & value_barrier_bn(condition);
a->flags ^= t;
b->flags ^= t;
/* conditionally swap the data */
for (i = 0; i < nwords; i++) {
- t = (a->d[i] ^ b->d[i]) & condition;
+ t = (a->d[i] ^ b->d[i]) & value_barrier_bn(condition);
a->d[i] ^= t;
b->d[i] ^= t;
}