[tor-bugs] #16970 [Tor]: Segfault in i386 ed25519_donna_pubkey_from_curve25519_pubkey

[Tor Bug Tracker & Wiki]

#16970: Segfault in i386 ed25519_donna_pubkey_from_curve25519_pubkey
------------------------+---------------------------------------------
     Reporter:  teor    |      Owner:
         Type:  defect  |     Status:  new
     Priority:  major   |  Milestone:  Tor: 0.2.7.x-final
    Component:  Tor     |    Version:  Tor: 0.2.7.2-alpha
   Resolution:          |   Keywords:  Post027Freeze TorCoreTeam201509
Actual Points:          |  Parent ID:
       Points:          |
------------------------+---------------------------------------------

Comment (by teor):

 The segfault occurs on line 146 of curve-25519-donna-sse2.h:
 {{{
  DONNA_INLINE static void
 curve25519_sub(bignum25519 out, const bignum25519 a, const bignum25519 b)
 {
         xmmi a0,a1,a2,b0,b1,b2;
         xmmi c1,c2;
         xmmi r0,r1;

         a0 = _mm_load_si128((xmmi*)a + 0);
         a1 = _mm_load_si128((xmmi*)a + 1);
         a2 = _mm_load_si128((xmmi*)a + 2);
         a0 = _mm_add_epi32(a0, packed2p0.v);
         a1 = _mm_add_epi32(a1, packed2p1.v);
         a2 = _mm_add_epi32(a2, packed2p2.v);
         b0 = _mm_load_si128((xmmi*)b + 0);
 }}}

--
Ticket URL: <https://trac.torproject.org/projects/tor/ticket/16970#comment:1>
Tor Bug Tracker & Wiki <https://trac.torproject.org/>
The Tor Project: anonymity online