Modify GOST-34.11 hash to avoid a GCC miscompilation.

For whatever reason GCC 7 on i386 miscompiles this loop under -O3. I was
not able to reduce the bug to a small testcase - extracting the problem
section of the code to its own file, it behaves correctly.

Also oddly, I was never able to repro this using Arch's gcc-multilib
i386 compiler. But when compiled with the 'native' i386 compiler in
a chroot it immediately fails.

See GH #1148 and GH #882

1 files changed, 4 insertions, 1 deletions

diff --git a/src/lib/hash/gost_3411/gost_3411.cpp b/src/lib/hash/gost_3411/gost_3411.cpp
index 2e2ed962d..27773c795 100644
--- a/src/lib/hash/gost_3411/gost_3411.cpp
+++ b/src/lib/hash/gost_3411/gost_3411.cpp
@@ -92,8 +92,11 @@ void GOST_34_11::compress_n(const uint8_t input[], size_t blocks)
 
          // P transformation
          for(size_t k = 0; k != 4; ++k)
+            {
+            const uint64_t UVk = U[k] ^ V[k];
             for(size_t l = 0; l != 8; ++l)
-               key[4*l+k] = get_byte(l, U[k]) ^ get_byte(l, V[k]);
+               key[4*l+k] = get_byte(l, UVk);
+            }
 
          m_cipher.set_key(key, 32);
          m_cipher.encrypt(&m_hash[8*j], S + 8*j);