openssl/ssl/s3_cbc.c

89     unsigned padding_length, good;
98     padding_length = rec->data[rec->length - 1];
99     good = constant_time_ge(rec->length, padding_length + overhead);
101     good &= constant_time_ge(block_size, padding_length + 1);
102     padding_length = good & (padding_length + 1);
103     rec->length -= padding_length;
104     rec->type |= padding_length << 8; /* kludge: pass padding length */
125     unsigned padding_length, good, to_check, i;
142     padding_length = rec->data[rec->length - 1];
153             !(padding_length & 1)) {
156         if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) && padding_length > 0) {
157             padding_length--;
163         rec->length -= padding_length + 1;
167     good = constant_time_ge(rec->length, overhead + padding_length);
172      * padding. We can't check just |padding_length+1| bytes because that
182         unsigned char mask = constant_time_ge_8(padding_length, i);
185          * The final |padding_length+1| bytes should all have the value
186          * |padding_length|. Therefore the XOR should be zero.
188         good &= ~(mask & (padding_length ^ b));
192      * If any of the final |padding_length+1| bytes had the wrong value, one
196     padding_length = good & (padding_length + 1);
197     rec->length -= padding_length;
198     rec->type |= padding_length << 8; /* kludge: pass padding length */