Cast nonce bytes to avoid undefined behaviour when left shifting.

Reported by oss-fuzz, fixes issue #13805.

ok beck@ tb@

1 files changed, 3 insertions, 3 deletions

diff --git a/src/lib/libcrypto/evp/e_chacha20poly1305.c b/src/lib/libcrypto/evp/e_chacha20poly1305.c
index a5cf8a19f2..2b9e7b1188 100644
--- a/src/lib/libcrypto/evp/e_chacha20poly1305.c
+++ b/src/lib/libcrypto/evp/e_chacha20poly1305.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: e_chacha20poly1305.c,v 1.19 2019/01/22 00:59:21 dlg Exp $ */
+/* $OpenBSD: e_chacha20poly1305.c,v 1.20 2019/03/24 12:04:12 jsing Exp $ */
 
 /*
  * Copyright (c) 2015 Reyk Floter <reyk@openbsd.org>
@@ -149,8 +149,8 @@ aead_chacha20_poly1305_seal(const EVP_AEAD_CTX *ctx, unsigned char *out,
                 return 0;
         }
 
-        ctr = (uint64_t)(nonce[0] | nonce[1] << 8 |
-            nonce[2] << 16 | nonce[3] << 24) << 32;
+        ctr = (uint64_t)((uint32_t)(nonce[0]) | (uint32_t)(nonce[1]) << 8 |
+            (uint32_t)(nonce[2]) << 16 | (uint32_t)(nonce[3]) << 24) << 32;
         iv = nonce + CHACHA20_CONSTANT_LEN;
 
         memset(poly1305_key, 0, sizeof(poly1305_key));