1 files changed, 207 insertions, 238 deletions

diff --git a/src/lib/libssl/s3_cbc.c b/src/lib/libssl/s3_cbc.c
index 443a31e746..d6cc9b4771 100644
--- a/src/lib/libssl/s3_cbc.c
+++ b/src/lib/libssl/s3_cbc.c
@@ -73,30 +73,33 @@
  * bits. They use the fact that arithmetic shift shifts-in the sign bit.
  * However, this is not ensured by the C standard so you may need to replace
  * them with something else on odd CPUs. */
-#define DUPLICATE_MSB_TO_ALL(x) ( (unsigned)( (int)(x) >> (sizeof(int)*8-1) ) )
+#define DUPLICATE_MSB_TO_ALL(x) ((unsigned)((int)(x) >> (sizeof(int) * 8 - 1)))
 #define DUPLICATE_MSB_TO_ALL_8(x) ((unsigned char)(DUPLICATE_MSB_TO_ALL(x)))
 
 /* constant_time_lt returns 0xff if a<b and 0x00 otherwise. */
-static unsigned constant_time_lt(unsigned a, unsigned b)
-        {
+static unsigned
+constant_time_lt(unsigned a, unsigned b)
+{
         a -= b;
         return DUPLICATE_MSB_TO_ALL(a);
-        }
+}
 
 /* constant_time_ge returns 0xff if a>=b and 0x00 otherwise. */
-static unsigned constant_time_ge(unsigned a, unsigned b)
-        {
+static unsigned
+constant_time_ge(unsigned a, unsigned b)
+{
         a -= b;
         return DUPLICATE_MSB_TO_ALL(~a);
-        }
+}
 
 /* constant_time_eq_8 returns 0xff if a==b and 0x00 otherwise. */
-static unsigned char constant_time_eq_8(unsigned a, unsigned b)
-        {
+static unsigned char
+constant_time_eq_8(unsigned a, unsigned b)
+{
         unsigned c = a ^ b;
         c--;
         return DUPLICATE_MSB_TO_ALL_8(c);
-        }
+}
 
 /* ssl3_cbc_remove_padding removes padding from the decrypted, SSLv3, CBC
  * record in |rec| by updating |rec->length| in constant time.
@@ -106,11 +109,10 @@ static unsigned char constant_time_eq_8(unsigned a, unsigned b)
  *   0: (in non-constant time) if the record is publicly invalid.
  *   1: if the padding was valid
  *  -1: otherwise. */
-int ssl3_cbc_remove_padding(const SSL* s,
-                            SSL3_RECORD *rec,
-                            unsigned block_size,
-                            unsigned mac_size)
-        {
+int
+ssl3_cbc_remove_padding(const SSL* s, SSL3_RECORD *rec, unsigned block_size,
+    unsigned mac_size)
+{
         unsigned padding_length, good;
         const unsigned overhead = 1 /* padding length byte */ + mac_size;
 
@@ -119,13 +121,13 @@ int ssl3_cbc_remove_padding(const SSL* s,
         if (overhead > rec->length)
                 return 0;
 
-        padding_length = rec->data[rec->length-1];
-        good = constant_time_ge(rec->length, padding_length+overhead);
+        padding_length = rec->data[rec->length - 1];
+        good = constant_time_ge(rec->length, padding_length + overhead);
         /* SSLv3 requires that the padding is minimal. */
-        good &= constant_time_ge(block_size, padding_length+1);
-        padding_length = good & (padding_length+1);
+        good &= constant_time_ge(block_size, padding_length + 1);
+        padding_length = good & (padding_length + 1);
         rec->length -= padding_length;
-        rec->type |= padding_length<<8; /* kludge: pass padding length */
+        rec->type |= padding_length << 8; /* kludge: pass padding length */
         return (int)((good & 1) | (~good & -1));
 }
 
@@ -140,16 +142,14 @@ int ssl3_cbc_remove_padding(const SSL* s,
  *   0: (in non-constant time) if the record is publicly invalid.
  *   1: if the padding was valid
  *  -1: otherwise. */
-int tls1_cbc_remove_padding(const SSL* s,
-                            SSL3_RECORD *rec,
-                            unsigned block_size,
-                            unsigned mac_size)
-        {
+int
+tls1_cbc_remove_padding(const SSL* s, SSL3_RECORD *rec, unsigned block_size,
+    unsigned mac_size)
+{
         unsigned padding_length, good, to_check, i;
         const unsigned overhead = 1 /* padding length byte */ + mac_size;
         /* Check if version requires explicit IV */
-        if (s->version >= TLS1_1_VERSION || s->version == DTLS1_BAD_VER)
-                {
+        if (s->version >= TLS1_1_VERSION || s->version == DTLS1_BAD_VER) {
                 /* These lengths are all public so we can test them in
                  * non-constant time.
                  */
@@ -159,40 +159,35 @@ int tls1_cbc_remove_padding(const SSL* s,
                 rec->data += block_size;
                 rec->input += block_size;
                 rec->length -= block_size;
-                }
-        else if (overhead > rec->length)
+        } else if (overhead > rec->length)
                 return 0;
 
-        padding_length = rec->data[rec->length-1];
+        padding_length = rec->data[rec->length - 1];
 
         /* NB: if compression is in operation the first packet may not be of
          * even length so the padding bug check cannot be performed. This bug
          * workaround has been around since SSLeay so hopefully it is either
          * fixed now or no buggy implementation supports compression [steve]
          */
-        if ( (s->options&SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand)
-                {
+        if ((s->options & SSL_OP_TLS_BLOCK_PADDING_BUG) && !s->expand) {
                 /* First packet is even in size, so check */
-                if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0",8) == 0) &&
-                    !(padding_length & 1))
-                        {
+                if ((memcmp(s->s3->read_sequence, "\0\0\0\0\0\0\0\0", 8) == 0) &&
+                    !(padding_length & 1)) {
                         s->s3->flags|=TLS1_FLAGS_TLS_PADDING_BUG;
-                        }
+                }
                 if ((s->s3->flags & TLS1_FLAGS_TLS_PADDING_BUG) &&
-                    padding_length > 0)
-                        {
+                    padding_length > 0) {
                         padding_length--;
-                        }
                 }
+        }
 
-        if (EVP_CIPHER_flags(s->enc_read_ctx->cipher)&EVP_CIPH_FLAG_AEAD_CIPHER)
-                {
+        if (EVP_CIPHER_flags(s->enc_read_ctx->cipher) & EVP_CIPH_FLAG_AEAD_CIPHER) {
                 /* padding is already verified */
                 rec->length -= padding_length + 1;
                 return 1;
-                }
+        }
 
-        good = constant_time_ge(rec->length, overhead+padding_length);
+        good = constant_time_ge(rec->length, overhead + padding_length);
         /* The padding consists of a length byte at the end of the record and
          * then that many bytes of padding, all with the same value as the
          * length byte. Thus, with the length byte included, there are i+1
@@ -203,17 +198,16 @@ int tls1_cbc_remove_padding(const SSL* s,
          * amount of padding possible. (Again, the length of the record is
          * public information so we can use it.) */
         to_check = 255; /* maximum amount of padding. */
-        if (to_check > rec->length-1)
-                to_check = rec->length-1;
+        if (to_check > rec->length - 1)
+                to_check = rec->length - 1;
 
-        for (i = 0; i < to_check; i++)
-                {
+        for (i = 0; i < to_check; i++) {
                 unsigned char mask = constant_time_ge(padding_length, i);
-                unsigned char b = rec->data[rec->length-1-i];
+                unsigned char b = rec->data[rec->length - 1 - i];
                 /* The final |padding_length+1| bytes should all have the value
                  * |padding_length|. Therefore the XOR should be zero. */
                 good &= ~(mask&(padding_length ^ b));
-                }
+        }
 
         /* If any of the final |padding_length+1| bytes had the wrong value,
          * one or more of the lower eight bits of |good| will be cleared. We
@@ -222,15 +216,15 @@ int tls1_cbc_remove_padding(const SSL* s,
         good &= good >> 4;
         good &= good >> 2;
         good &= good >> 1;
-        good <<= sizeof(good)*8-1;
+        good <<= sizeof(good)*8 - 1;
         good = DUPLICATE_MSB_TO_ALL(good);
 
-        padding_length = good & (padding_length+1);
+        padding_length = good & (padding_length + 1);
         rec->length -= padding_length;
         rec->type |= padding_length<<8; /* kludge: pass padding length */
 
         return (int)((good & 1) | (~good & -1));
-        }
+}
 
 /* ssl3_cbc_copy_mac copies |md_size| bytes from the end of |rec| to |out| in
  * constant time (independent of the concrete value of rec->length, which may
@@ -251,12 +245,12 @@ int tls1_cbc_remove_padding(const SSL* s,
  */
 #define CBC_MAC_ROTATE_IN_PLACE
 
-void ssl3_cbc_copy_mac(unsigned char* out,
-                       const SSL3_RECORD *rec,
-                       unsigned md_size,unsigned orig_len)
-        {
+void
+ssl3_cbc_copy_mac(unsigned char* out, const SSL3_RECORD *rec,
+    unsigned md_size, unsigned orig_len)
+{
 #if defined(CBC_MAC_ROTATE_IN_PLACE)
-        unsigned char rotated_mac_buf[64+EVP_MAX_MD_SIZE];
+        unsigned char rotated_mac_buf[64 + EVP_MAX_MD_SIZE];
         unsigned char *rotated_mac;
 #else
         unsigned char rotated_mac[EVP_MAX_MD_SIZE];
@@ -276,7 +270,7 @@ void ssl3_cbc_copy_mac(unsigned char* out,
         OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
 
 #if defined(CBC_MAC_ROTATE_IN_PLACE)
-        rotated_mac = rotated_mac_buf + ((0-(size_t)rotated_mac_buf)&63);
+        rotated_mac = rotated_mac_buf + ((0 - (size_t)rotated_mac_buf)&63);
 #endif
 
         /* This information is public so it's safe to branch based on it. */
@@ -290,42 +284,39 @@ void ssl3_cbc_copy_mac(unsigned char* out,
          * figure out that it can remove div_spoiler as that would require it
          * to prove that md_size is always even, which I hope is beyond it. */
         div_spoiler = md_size >> 1;
-        div_spoiler <<= (sizeof(div_spoiler)-1)*8;
+        div_spoiler <<= (sizeof(div_spoiler) - 1) * 8;
         rotate_offset = (div_spoiler + mac_start - scan_start) % md_size;
 
         memset(rotated_mac, 0, md_size);
-        for (i = scan_start, j = 0; i < orig_len; i++)
-                {
+        for (i = scan_start, j = 0; i < orig_len; i++) {
                 unsigned char mac_started = constant_time_ge(i, mac_start);
                 unsigned char mac_ended = constant_time_ge(i, mac_end);
                 unsigned char b = rec->data[i];
                 rotated_mac[j++] |= b & mac_started & ~mac_ended;
-                j &= constant_time_lt(j,md_size);
-                }
+                j &= constant_time_lt(j, md_size);
+        }
 
         /* Now rotate the MAC */
 #if defined(CBC_MAC_ROTATE_IN_PLACE)
         j = 0;
-        for (i = 0; i < md_size; i++)
-                {
+        for (i = 0; i < md_size; i++) {
                 /* in case cache-line is 32 bytes, touch second line */
                 ((volatile unsigned char *)rotated_mac)[rotate_offset^32];
                 out[j++] = rotated_mac[rotate_offset++];
-                rotate_offset &= constant_time_lt(rotate_offset,md_size);
-                }
+                rotate_offset &= constant_time_lt(rotate_offset, md_size);
+        }
 #else
         memset(out, 0, md_size);
         rotate_offset = md_size - rotate_offset;
-        rotate_offset &= constant_time_lt(rotate_offset,md_size);
-        for (i = 0; i < md_size; i++)
-                {
+        rotate_offset &= constant_time_lt(rotate_offset, md_size);
+        for (i = 0; i < md_size; i++) {
                 for (j = 0; j < md_size; j++)
                         out[j] |= rotated_mac[i] & constant_time_eq_8(j, rotate_offset);
                 rotate_offset++;
-                rotate_offset &= constant_time_lt(rotate_offset,md_size);
-                }
-#endif
+                rotate_offset &= constant_time_lt(rotate_offset, md_size);
         }
+#endif
+}
 
 /* u32toLE serialises an unsigned, 32-bit number (n) as four bytes at (p) in
  * little-endian order. The value of p is advanced by four. */
@@ -338,81 +329,83 @@ void ssl3_cbc_copy_mac(unsigned char* out,
 /* These functions serialize the state of a hash and thus perform the standard
  * "final" operation without adding the padding and length that such a function
  * typically does. */
-static void tls1_md5_final_raw(void* ctx, unsigned char *md_out)
-        {
+static void
+tls1_md5_final_raw(void* ctx, unsigned char *md_out)
+{
         MD5_CTX *md5 = ctx;
         u32toLE(md5->A, md_out);
         u32toLE(md5->B, md_out);
         u32toLE(md5->C, md_out);
         u32toLE(md5->D, md_out);
-        }
+}
 
-static void tls1_sha1_final_raw(void* ctx, unsigned char *md_out)
-        {
+static void
+tls1_sha1_final_raw(void* ctx, unsigned char *md_out)
+{
         SHA_CTX *sha1 = ctx;
         l2n(sha1->h0, md_out);
         l2n(sha1->h1, md_out);
         l2n(sha1->h2, md_out);
         l2n(sha1->h3, md_out);
         l2n(sha1->h4, md_out);
-        }
+}
 #define LARGEST_DIGEST_CTX SHA_CTX
 
 #ifndef OPENSSL_NO_SHA256
-static void tls1_sha256_final_raw(void* ctx, unsigned char *md_out)
-        {
+static void
+tls1_sha256_final_raw(void* ctx, unsigned char *md_out)
+{
         SHA256_CTX *sha256 = ctx;
         unsigned i;
 
-        for (i = 0; i < 8; i++)
-                {
+        for (i = 0; i < 8; i++) {
                 l2n(sha256->h[i], md_out);
-                }
         }
+}
 #undef  LARGEST_DIGEST_CTX
 #define LARGEST_DIGEST_CTX SHA256_CTX
 #endif
 
 #ifndef OPENSSL_NO_SHA512
-static void tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
-        {
+static void
+tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
+{
         SHA512_CTX *sha512 = ctx;
         unsigned i;
 
-        for (i = 0; i < 8; i++)
-                {
+        for (i = 0; i < 8; i++) {
                 l2n8(sha512->h[i], md_out);
-                }
         }
+}
 #undef  LARGEST_DIGEST_CTX
 #define LARGEST_DIGEST_CTX SHA512_CTX
 #endif
 
 /* ssl3_cbc_record_digest_supported returns 1 iff |ctx| uses a hash function
  * which ssl3_cbc_digest_record supports. */
-char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
-        {
+char
+ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
+{
 #ifdef OPENSSL_FIPS
         if (FIPS_mode())
                 return 0;
 #endif
-        switch (EVP_MD_CTX_type(ctx))
-                {
-                case NID_md5:
-                case NID_sha1:
+        switch (EVP_MD_CTX_type(ctx)) {
+        case NID_md5:
+        case NID_sha1:
 #ifndef OPENSSL_NO_SHA256
-                case NID_sha224:
-                case NID_sha256:
+        case NID_sha224:
+        case NID_sha256:
 #endif
 #ifndef OPENSSL_NO_SHA512
-                case NID_sha384:
-                case NID_sha512:
+        case NID_sha384:
+        case NID_sha512:
 #endif
-                        return 1;
-                default:
-                        return 0;
-                }
+                return 1;
+        default:
+                return 0;
         }
+}
 
 /* ssl3_cbc_digest_record computes the MAC of a decrypted, padded SSLv3/TLS
  * record.
@@ -433,26 +426,21 @@ char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
  * functions, above, we know that data_plus_mac_size is large enough to contain
  * a padding byte and MAC. (If the padding was invalid, it might contain the
  * padding too. ) */
-void ssl3_cbc_digest_record(
-        const EVP_MD_CTX *ctx,
-        unsigned char* md_out,
-        size_t* md_out_size,
-        const unsigned char header[13],
-        const unsigned char *data,
-        size_t data_plus_mac_size,
-        size_t data_plus_mac_plus_padding_size,
-        const unsigned char *mac_secret,
-        unsigned mac_secret_length,
-        char is_sslv3)
-        {
+void ssl3_cbc_digest_record(const EVP_MD_CTX *ctx, unsigned char* md_out,
+    size_t* md_out_size, const unsigned char header[13],
+    const unsigned char *data, size_t data_plus_mac_size,
+    size_t data_plus_mac_plus_padding_size, const unsigned char *mac_secret,
+    unsigned mac_secret_length, char is_sslv3)
+{
         union { double align;
-                unsigned char c[sizeof(LARGEST_DIGEST_CTX)]; } md_state;
+                unsigned char c[sizeof(LARGEST_DIGEST_CTX)];
+        } md_state;
         void (*md_final_raw)(void *ctx, unsigned char *md_out);
         void (*md_transform)(void *ctx, const unsigned char *block);
         unsigned md_size, md_block_size = 64;
         unsigned sslv3_pad_length = 40, header_length, variance_blocks,
-                 len, max_mac_bytes, num_blocks,
-                 num_starting_blocks, k, mac_end_offset, c, index_a, index_b;
+        len, max_mac_bytes, num_blocks,
+        num_starting_blocks, k, mac_end_offset, c, index_a, index_b;
         unsigned int bits;      /* at most 18 bits */
         unsigned char length_bytes[MAX_HASH_BIT_COUNT_BYTES];
         /* hmac_pad is the masked HMAC key. */
@@ -470,78 +458,74 @@ void ssl3_cbc_digest_record(
          * many possible overflows later in this function. */
         OPENSSL_assert(data_plus_mac_plus_padding_size < 1024*1024);
 
-        switch (EVP_MD_CTX_type(ctx))
-                {
-                case NID_md5:
-                        MD5_Init((MD5_CTX*)md_state.c);
-                        md_final_raw = tls1_md5_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
-                        md_size = 16;
-                        sslv3_pad_length = 48;
-                        length_is_big_endian = 0;
-                        break;
-                case NID_sha1:
-                        SHA1_Init((SHA_CTX*)md_state.c);
-                        md_final_raw = tls1_sha1_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA1_Transform;
-                        md_size = 20;
-                        break;
+        switch (EVP_MD_CTX_type(ctx)) {
+        case NID_md5:
+                MD5_Init((MD5_CTX*)md_state.c);
+                md_final_raw = tls1_md5_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) MD5_Transform;
+                md_size = 16;
+                sslv3_pad_length = 48;
+                length_is_big_endian = 0;
+                break;
+        case NID_sha1:
+                SHA1_Init((SHA_CTX*)md_state.c);
+                md_final_raw = tls1_sha1_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA1_Transform;
+                md_size = 20;
+                break;
 #ifndef OPENSSL_NO_SHA256
-                case NID_sha224:
-                        SHA224_Init((SHA256_CTX*)md_state.c);
-                        md_final_raw = tls1_sha256_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
-                        md_size = 224/8;
-                        break;
-                case NID_sha256:
-                        SHA256_Init((SHA256_CTX*)md_state.c);
-                        md_final_raw = tls1_sha256_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
-                        md_size = 32;
-                        break;
+        case NID_sha224:
+                SHA224_Init((SHA256_CTX*)md_state.c);
+                md_final_raw = tls1_sha256_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
+                md_size = 224/8;
+                break;
+        case NID_sha256:
+                SHA256_Init((SHA256_CTX*)md_state.c);
+                md_final_raw = tls1_sha256_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
+                md_size = 32;
+                break;
 #endif
 #ifndef OPENSSL_NO_SHA512
-                case NID_sha384:
-                        SHA384_Init((SHA512_CTX*)md_state.c);
-                        md_final_raw = tls1_sha512_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
-                        md_size = 384/8;
-                        md_block_size = 128;
-                        md_length_size = 16;
-                        break;
-                case NID_sha512:
-                        SHA512_Init((SHA512_CTX*)md_state.c);
-                        md_final_raw = tls1_sha512_final_raw;
-                        md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
-                        md_size = 64;
-                        md_block_size = 128;
-                        md_length_size = 16;
-                        break;
+        case NID_sha384:
+                SHA384_Init((SHA512_CTX*)md_state.c);
+                md_final_raw = tls1_sha512_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
+                md_size = 384/8;
+                md_block_size = 128;
+                md_length_size = 16;
+                break;
+        case NID_sha512:
+                SHA512_Init((SHA512_CTX*)md_state.c);
+                md_final_raw = tls1_sha512_final_raw;
+                md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA512_Transform;
+                md_size = 64;
+                md_block_size = 128;
+                md_length_size = 16;
+                break;
 #endif
-                default:
-                        /* ssl3_cbc_record_digest_supported should have been
-                         * called first to check that the hash function is
-                         * supported. */
-                        OPENSSL_assert(0);
-                        if (md_out_size)
-                                *md_out_size = -1;
-                        return;
-                }
+        default:
+                /* ssl3_cbc_record_digest_supported should have been
+                 * called first to check that the hash function is
+                 * supported. */
+                OPENSSL_assert(0);
+                if (md_out_size)
+                        *md_out_size = -1;
+                return;
+        }
 
         OPENSSL_assert(md_length_size <= MAX_HASH_BIT_COUNT_BYTES);
         OPENSSL_assert(md_block_size <= MAX_HASH_BLOCK_SIZE);
         OPENSSL_assert(md_size <= EVP_MAX_MD_SIZE);
 
         header_length = 13;
-        if (is_sslv3)
-                {
-                header_length =
-                        mac_secret_length +
-                        sslv3_pad_length +
-                        8 /* sequence number */ +
-                        1 /* record type */ +
-                        2 /* record length */;
-                }
+        if (is_sslv3) {
+                header_length = mac_secret_length + sslv3_pad_length +
+                    8 /* sequence number */ +
+                    1 /* record type */ +
+                    2 /* record length */;
+        }
 
         /* variance_blocks is the number of blocks of the hash that we have to
          * calculate in constant time because they could be altered by the
@@ -597,15 +581,13 @@ void ssl3_cbc_digest_record(
 
         /* For SSLv3, if we're going to have any starting blocks then we need
          * at least two because the header is larger than a single block. */
-        if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0))
-                {
+        if (num_blocks > variance_blocks + (is_sslv3 ? 1 : 0)) {
                 num_starting_blocks = num_blocks - variance_blocks;
                 k = md_block_size*num_starting_blocks;
-                }
+        }
 
         bits = 8*mac_end_offset;
-        if (!is_sslv3)
-                {
+        if (!is_sslv3) {
                 /* Compute the initial HMAC block. For SSLv3, the padding and
                  * secret bytes are included in |header| because they take more
                  * than a single block. */
@@ -617,51 +599,44 @@ void ssl3_cbc_digest_record(
                         hmac_pad[i] ^= 0x36;
 
                 md_transform(md_state.c, hmac_pad);
-                }
+        }
 
-        if (length_is_big_endian)
-                {
-                memset(length_bytes,0,md_length_size-4);
-                length_bytes[md_length_size-4] = (unsigned char)(bits>>24);
-                length_bytes[md_length_size-3] = (unsigned char)(bits>>16);
-                length_bytes[md_length_size-2] = (unsigned char)(bits>>8);
-                length_bytes[md_length_size-1] = (unsigned char)bits;
-                }
-        else
-                {
-                memset(length_bytes,0,md_length_size);
-                length_bytes[md_length_size-5] = (unsigned char)(bits>>24);
-                length_bytes[md_length_size-6] = (unsigned char)(bits>>16);
-                length_bytes[md_length_size-7] = (unsigned char)(bits>>8);
-                length_bytes[md_length_size-8] = (unsigned char)bits;
-                }
+        if (length_is_big_endian) {
+                memset(length_bytes, 0, md_length_size - 4);
+                length_bytes[md_length_size - 4] = (unsigned char)(bits >> 24);
+                length_bytes[md_length_size - 3] = (unsigned char)(bits >> 16);
+                length_bytes[md_length_size - 2] = (unsigned char)(bits >> 8);
+                length_bytes[md_length_size - 1] = (unsigned char)bits;
+        } else {
+                memset(length_bytes, 0, md_length_size);
+                length_bytes[md_length_size - 5] = (unsigned char)(bits >> 24);
+                length_bytes[md_length_size - 6] = (unsigned char)(bits >> 16);
+                length_bytes[md_length_size - 7] = (unsigned char)(bits >> 8);
+                length_bytes[md_length_size - 8] = (unsigned char)bits;
+        }
 
-        if (k > 0)
-                {
-                if (is_sslv3)
-                        {
+        if (k > 0) {
+                if (is_sslv3) {
                         /* The SSLv3 header is larger than a single block.
                          * overhang is the number of bytes beyond a single
                          * block that the header consumes: either 7 bytes
                          * (SHA1) or 11 bytes (MD5). */
-                        unsigned overhang = header_length-md_block_size;
+                        unsigned overhang = header_length - md_block_size;
                         md_transform(md_state.c, header);
                         memcpy(first_block, header + md_block_size, overhang);
-                        memcpy(first_block + overhang, data, md_block_size-overhang);
+                        memcpy(first_block + overhang, data, md_block_size - overhang);
                         md_transform(md_state.c, first_block);
                         for (i = 1; i < k/md_block_size - 1; i++)
                                 md_transform(md_state.c, data + md_block_size*i - overhang);
-                        }
-                else
-                        {
+                } else {
                         /* k is a multiple of md_block_size. */
                         memcpy(first_block, header, 13);
-                        memcpy(first_block+13, data, md_block_size-13);
+                        memcpy(first_block + 13, data, md_block_size - 13);
                         md_transform(md_state.c, first_block);
                         for (i = 1; i < k/md_block_size; i++)
                                 md_transform(md_state.c, data + md_block_size*i - 13);
-                        }
                 }
+        }
 
         memset(mac_out, 0, sizeof(mac_out));
 
@@ -669,22 +644,20 @@ void ssl3_cbc_digest_record(
          * it in constant time. If the |i==index_a| then we'll include the 0x80
          * bytes and zero pad etc. For each block we selectively copy it, in
          * constant time, to |mac_out|. */
-        for (i = num_starting_blocks; i <= num_starting_blocks+variance_blocks; i++)
-                {
+        for (i = num_starting_blocks; i <= num_starting_blocks + variance_blocks; i++) {
                 unsigned char block[MAX_HASH_BLOCK_SIZE];
                 unsigned char is_block_a = constant_time_eq_8(i, index_a);
                 unsigned char is_block_b = constant_time_eq_8(i, index_b);
-                for (j = 0; j < md_block_size; j++)
-                        {
+                for (j = 0; j < md_block_size; j++) {
                         unsigned char b = 0, is_past_c, is_past_cp1;
                         if (k < header_length)
                                 b = header[k];
                         else if (k < data_plus_mac_plus_padding_size + header_length)
-                                b = data[k-header_length];
+                                b = data[k - header_length];
                         k++;
 
                         is_past_c = is_block_a & constant_time_ge(j, c);
-                        is_past_cp1 = is_block_a & constant_time_ge(j, c+1);
+                        is_past_cp1 = is_block_a & constant_time_ge(j, c + 1);
                         /* If this is the block containing the end of the
                          * application data, and we are at the offset for the
                          * 0x80 value, then overwrite b with 0x80. */
@@ -701,46 +674,42 @@ void ssl3_cbc_digest_record(
 
                         /* The final bytes of one of the blocks contains the
                          * length. */
-                        if (j >= md_block_size - md_length_size)
-                                {
+                        if (j >= md_block_size - md_length_size) {
                                 /* If this is index_b, write a length byte. */
-                                b = (b&~is_block_b) | (is_block_b&length_bytes[j-(md_block_size-md_length_size)]);
-                                }
-                        block[j] = b;
+                                b = (b&~is_block_b) | (is_block_b&length_bytes[j - (md_block_size - md_length_size)]);
                         }
+                        block[j] = b;
+                }
 
                 md_transform(md_state.c, block);
                 md_final_raw(md_state.c, block);
                 /* If this is index_b, copy the hash value to |mac_out|. */
                 for (j = 0; j < md_size; j++)
                         mac_out[j] |= block[j]&is_block_b;
-                }
+        }
 
         EVP_MD_CTX_init(&md_ctx);
         EVP_DigestInit_ex(&md_ctx, ctx->digest, NULL /* engine */);
-        if (is_sslv3)
-                {
+        if (is_sslv3) {
                 /* We repurpose |hmac_pad| to contain the SSLv3 pad2 block. */
                 memset(hmac_pad, 0x5c, sslv3_pad_length);
 
                 EVP_DigestUpdate(&md_ctx, mac_secret, mac_secret_length);
                 EVP_DigestUpdate(&md_ctx, hmac_pad, sslv3_pad_length);
                 EVP_DigestUpdate(&md_ctx, mac_out, md_size);
-                }
-        else
-                {
+        } else {
                 /* Complete the HMAC in the standard manner. */
                 for (i = 0; i < md_block_size; i++)
                         hmac_pad[i] ^= 0x6a;
 
                 EVP_DigestUpdate(&md_ctx, hmac_pad, md_block_size);
                 EVP_DigestUpdate(&md_ctx, mac_out, md_size);
-                }
+        }
         EVP_DigestFinal(&md_ctx, md_out, &md_out_size_u);
         if (md_out_size)
                 *md_out_size = md_out_size_u;
         EVP_MD_CTX_cleanup(&md_ctx);
-        }
+}
 
 #ifdef OPENSSL_FIPS
 
@@ -749,10 +718,10 @@ void ssl3_cbc_digest_record(
  * by digesting additional data.
  */
 
-void tls_fips_digest_extra(
-        const EVP_CIPHER_CTX *cipher_ctx, EVP_MD_CTX *mac_ctx,
-        const unsigned char *data, size_t data_len, size_t orig_len)
-        {
+void tls_fips_digest_extra(const EVP_CIPHER_CTX *cipher_ctx,
+    EVP_MD_CTX *mac_ctx, const unsigned char *data, size_t data_len,
+    size_t orig_len)
+{
         size_t block_size, digest_pad, blocks_data, blocks_orig;
         if (EVP_CIPHER_CTX_mode(cipher_ctx) != EVP_CIPH_CBC_MODE)
                 return;
@@ -785,6 +754,6 @@ void tls_fips_digest_extra(
          * length TLS buffer. 
          */
         EVP_DigestSignUpdate(mac_ctx, data,
-                                (blocks_orig - blocks_data + 1) * block_size);
-        }
+        (blocks_orig - blocks_data + 1) * block_size);
+}
 #endif