From 6d0684df633c1d65591591144f90da640dc2c601 Mon Sep 17 00:00:00 2001
From: Thom Wiggers <thom@thomwiggers.nl>
Date: Wed, 18 Nov 2020 17:56:21 +0100
Subject: [PATCH] Fix more overflowing muls in Frodo

---
 crypto_kem/frodokem1344aes/clean/util.c   | 2 +-
 crypto_kem/frodokem1344aes/opt/util.c     | 2 +-
 crypto_kem/frodokem1344shake/clean/util.c | 2 +-
 crypto_kem/frodokem1344shake/opt/util.c   | 2 +-
 crypto_kem/frodokem640aes/clean/util.c    | 2 +-
 crypto_kem/frodokem640aes/opt/util.c      | 2 +-
 crypto_kem/frodokem640shake/clean/util.c  | 2 +-
 crypto_kem/frodokem640shake/opt/util.c    | 2 +-
 crypto_kem/frodokem976aes/clean/util.c    | 2 +-
 crypto_kem/frodokem976aes/opt/util.c      | 2 +-
 crypto_kem/frodokem976shake/clean/util.c  | 2 +-
 crypto_kem/frodokem976shake/opt/util.c    | 2 +-
 12 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/crypto_kem/frodokem1344aes/clean/util.c b/crypto_kem/frodokem1344aes/clean/util.c
index ab565fca..53bb63fa 100644
--- a/crypto_kem/frodokem1344aes/clean/util.c
+++ b/crypto_kem/frodokem1344aes/clean/util.c
@@ -58,7 +58,7 @@ void PQCLEAN_FRODOKEM1344AES_CLEAN_mul_add_sb_plus_e(uint16_t *out, const uint16
         for (i = 0; i < PARAMS_NBAR; i++) {
             out[k * PARAMS_NBAR + i] = e[k * PARAMS_NBAR + i];
             for (j = 0; j < PARAMS_N; j++) {
-                out[k * PARAMS_NBAR + i] += s[k * PARAMS_N + j] * b[j * PARAMS_NBAR + i];
+                out[k * PARAMS_NBAR + i] += (uint16_t)(s[k * PARAMS_N + j] * (uint32_t)b[j * PARAMS_NBAR + i]);
             }
             out[k * PARAMS_NBAR + i] = (uint32_t)(out[k * PARAMS_NBAR + i]) & ((1 << PARAMS_LOGQ) - 1);
         }
diff --git a/crypto_kem/frodokem1344aes/opt/util.c b/crypto_kem/frodokem1344aes/opt/util.c
index 9e617aa3..ddce506c 100644
--- a/crypto_kem/frodokem1344aes/opt/util.c
+++ b/crypto_kem/frodokem1344aes/opt/util.c
@@ -58,7 +58,7 @@ void PQCLEAN_FRODOKEM1344AES_OPT_mul_add_sb_plus_e(uint16_t *out, const uint16_t
         for (i = 0; i < PARAMS_NBAR; i++) {
             out[k * PARAMS_NBAR + i] = e[k * PARAMS_NBAR + i];
             for (j = 0; j < PARAMS_N; j++) {
-                out[k * PARAMS_NBAR + i] += s[k * PARAMS_N + j] * b[j * PARAMS_NBAR + i];
+                out[k * PARAMS_NBAR + i] += (uint16_t)(s[k * PARAMS_N + j] * (uint32_t)b[j * PARAMS_NBAR + i]);
             }
             out[k * PARAMS_NBAR + i] = (uint32_t)(out[k * PARAMS_NBAR + i]) & ((1 << PARAMS_LOGQ) - 1);
         }
diff --git a/crypto_kem/frodokem1344shake/clean/util.c b/crypto_kem/frodokem1344shake/clean/util.c
index c8b24c85..87cde592 100644
--- a/crypto_kem/frodokem1344shake/clean/util.c
+++ b/crypto_kem/frodokem1344shake/clean/util.c
@@ -58,7 +58,7 @@ void PQCLEAN_FRODOKEM1344SHAKE_CLEAN_mul_add_sb_plus_e(uint16_t *out, const uint
         for (i = 0; i < PARAMS_NBAR; i++) {
             out[k * PARAMS_NBAR + i] = e[k * PARAMS_NBAR + i];
             for (j = 0; j < PARAMS_N; j++) {
-                out[k * PARAMS_NBAR + i] += s[k * PARAMS_N + j] * b[j * PARAMS_NBAR + i];
+                out[k * PARAMS_NBAR + i] += (uint16_t)(s[k * PARAMS_N + j] * (uint32_t)b[j * PARAMS_NBAR + i]);
             }
             out[k * PARAMS_NBAR + i] = (uint32_t)(out[k * PARAMS_NBAR + i]) & ((1 << PARAMS_LOGQ) - 1);
         }
diff --git a/crypto_kem/frodokem1344shake/opt/util.c b/crypto_kem/frodokem1344shake/opt/util.c
index 6f6e8d66..38cc33db 100644
--- a/crypto_kem/frodokem1344shake/opt/util.c
+++ b/crypto_kem/frodokem1344shake/opt/util.c
@@ -58,7 +58,7 @@ void PQCLEAN_FRODOKEM1344SHAKE_OPT_mul_add_sb_plus_e(uint16_t *out, const uint16
         for (i = 0; i < PARAMS_NBAR; i++) {
             out[k * PARAMS_NBAR + i] = e[k * PARAMS_NBAR + i];
             for (j = 0; j < PARAMS_N; j++) {
-                out[k * PARAMS_NBAR + i] += s[k * PARAMS_N + j] * b[j * PARAMS_NBAR + i];
+                out[k * PARAMS_NBAR + i] += (uint16_t)(s[k * PARAMS_N + j] * (uint32_t)b[j * PARAMS_NBAR + i]);
             }
             out[k * PARAMS_NBAR + i] = (uint32_t)(out[k * PARAMS_NBAR + i]) & ((1 << PARAMS_LOGQ) - 1);
         }
diff --git a/crypto_kem/frodokem640aes/clean/util.c b/crypto_kem/frodokem640aes/clean/util.c
index bdba92e0..afcd1d56 100644
--- a/crypto_kem/frodokem640aes/clean/util.c
+++ b/crypto_kem/frodokem640aes/clean/util.c
@@ -58,7 +58,7 @@ void PQCLEAN_FRODOKEM640AES_CLEAN_mul_add_sb_plus_e(uint16_t *out, const uint16_
         for (i = 0; i < PARAMS_NBAR; i++) {
             out[k * PARAMS_NBAR + i] = e[k * PARAMS_NBAR + i];
             for (j = 0; j < PARAMS_N; j++) {
-                out[k * PARAMS_NBAR + i] += s[k * PARAMS_N + j] * b[j * PARAMS_NBAR + i];
+                out[k * PARAMS_NBAR + i] += (uint16_t)(s[k * PARAMS_N + j] * (uint32_t)b[j * PARAMS_NBAR + i]);
             }
             out[k * PARAMS_NBAR + i] = (uint32_t)(out[k * PARAMS_NBAR + i]) & ((1 << PARAMS_LOGQ) - 1);
         }
diff --git a/crypto_kem/frodokem640aes/opt/util.c b/crypto_kem/frodokem640aes/opt/util.c
index 5cdd6ca3..bd4aa970 100644
--- a/crypto_kem/frodokem640aes/opt/util.c
+++ b/crypto_kem/frodokem640aes/opt/util.c
@@ -58,7 +58,7 @@ void PQCLEAN_FRODOKEM640AES_OPT_mul_add_sb_plus_e(uint16_t *out, const uint16_t
         for (i = 0; i < PARAMS_NBAR; i++) {
             out[k * PARAMS_NBAR + i] = e[k * PARAMS_NBAR + i];
             for (j = 0; j < PARAMS_N; j++) {
-                out[k * PARAMS_NBAR + i] += s[k * PARAMS_N + j] * b[j * PARAMS_NBAR + i];
+                out[k * PARAMS_NBAR + i] += (uint16_t)(s[k * PARAMS_N + j] * (uint32_t)b[j * PARAMS_NBAR + i]);
             }
             out[k * PARAMS_NBAR + i] = (uint32_t)(out[k * PARAMS_NBAR + i]) & ((1 << PARAMS_LOGQ) - 1);
         }
diff --git a/crypto_kem/frodokem640shake/clean/util.c b/crypto_kem/frodokem640shake/clean/util.c
index ace911bd..6056adff 100644
--- a/crypto_kem/frodokem640shake/clean/util.c
+++ b/crypto_kem/frodokem640shake/clean/util.c
@@ -58,7 +58,7 @@ void PQCLEAN_FRODOKEM640SHAKE_CLEAN_mul_add_sb_plus_e(uint16_t *out, const uint1
         for (i = 0; i < PARAMS_NBAR; i++) {
             out[k * PARAMS_NBAR + i] = e[k * PARAMS_NBAR + i];
             for (j = 0; j < PARAMS_N; j++) {
-                out[k * PARAMS_NBAR + i] += s[k * PARAMS_N + j] * b[j * PARAMS_NBAR + i];
+                out[k * PARAMS_NBAR + i] += (uint16_t)(s[k * PARAMS_N + j] * (uint32_t)b[j * PARAMS_NBAR + i]);
             }
             out[k * PARAMS_NBAR + i] = (uint32_t)(out[k * PARAMS_NBAR + i]) & ((1 << PARAMS_LOGQ) - 1);
         }
diff --git a/crypto_kem/frodokem640shake/opt/util.c b/crypto_kem/frodokem640shake/opt/util.c
index 1b3a5825..e466f92f 100644
--- a/crypto_kem/frodokem640shake/opt/util.c
+++ b/crypto_kem/frodokem640shake/opt/util.c
@@ -58,7 +58,7 @@ void PQCLEAN_FRODOKEM640SHAKE_OPT_mul_add_sb_plus_e(uint16_t *out, const uint16_
         for (i = 0; i < PARAMS_NBAR; i++) {
             out[k * PARAMS_NBAR + i] = e[k * PARAMS_NBAR + i];
             for (j = 0; j < PARAMS_N; j++) {
-                out[k * PARAMS_NBAR + i] += s[k * PARAMS_N + j] * b[j * PARAMS_NBAR + i];
+                out[k * PARAMS_NBAR + i] += (uint16_t)(s[k * PARAMS_N + j] * (uint32_t)b[j * PARAMS_NBAR + i]);
             }
             out[k * PARAMS_NBAR + i] = (uint32_t)(out[k * PARAMS_NBAR + i]) & ((1 << PARAMS_LOGQ) - 1);
         }
diff --git a/crypto_kem/frodokem976aes/clean/util.c b/crypto_kem/frodokem976aes/clean/util.c
index c8a76b81..e4225e67 100644
--- a/crypto_kem/frodokem976aes/clean/util.c
+++ b/crypto_kem/frodokem976aes/clean/util.c
@@ -58,7 +58,7 @@ void PQCLEAN_FRODOKEM976AES_CLEAN_mul_add_sb_plus_e(uint16_t *out, const uint16_
         for (i = 0; i < PARAMS_NBAR; i++) {
             out[k * PARAMS_NBAR + i] = e[k * PARAMS_NBAR + i];
             for (j = 0; j < PARAMS_N; j++) {
-                out[k * PARAMS_NBAR + i] += s[k * PARAMS_N + j] * b[j * PARAMS_NBAR + i];
+                out[k * PARAMS_NBAR + i] += (uint16_t)(s[k * PARAMS_N + j] * (uint32_t)b[j * PARAMS_NBAR + i]);
             }
             out[k * PARAMS_NBAR + i] = (uint32_t)(out[k * PARAMS_NBAR + i]) & ((1 << PARAMS_LOGQ) - 1);
         }
diff --git a/crypto_kem/frodokem976aes/opt/util.c b/crypto_kem/frodokem976aes/opt/util.c
index cac6b449..ae9e31fd 100644
--- a/crypto_kem/frodokem976aes/opt/util.c
+++ b/crypto_kem/frodokem976aes/opt/util.c
@@ -58,7 +58,7 @@ void PQCLEAN_FRODOKEM976AES_OPT_mul_add_sb_plus_e(uint16_t *out, const uint16_t
         for (i = 0; i < PARAMS_NBAR; i++) {
             out[k * PARAMS_NBAR + i] = e[k * PARAMS_NBAR + i];
             for (j = 0; j < PARAMS_N; j++) {
-                out[k * PARAMS_NBAR + i] += s[k * PARAMS_N + j] * b[j * PARAMS_NBAR + i];
+                out[k * PARAMS_NBAR + i] += (uint16_t)(s[k * PARAMS_N + j] * (uint32_t)b[j * PARAMS_NBAR + i]);
             }
             out[k * PARAMS_NBAR + i] = (uint32_t)(out[k * PARAMS_NBAR + i]) & ((1 << PARAMS_LOGQ) - 1);
         }
diff --git a/crypto_kem/frodokem976shake/clean/util.c b/crypto_kem/frodokem976shake/clean/util.c
index 8360be6d..2242a28c 100644
--- a/crypto_kem/frodokem976shake/clean/util.c
+++ b/crypto_kem/frodokem976shake/clean/util.c
@@ -58,7 +58,7 @@ void PQCLEAN_FRODOKEM976SHAKE_CLEAN_mul_add_sb_plus_e(uint16_t *out, const uint1
         for (i = 0; i < PARAMS_NBAR; i++) {
             out[k * PARAMS_NBAR + i] = e[k * PARAMS_NBAR + i];
             for (j = 0; j < PARAMS_N; j++) {
-                out[k * PARAMS_NBAR + i] += s[k * PARAMS_N + j] * b[j * PARAMS_NBAR + i];
+                out[k * PARAMS_NBAR + i] += (uint16_t)(s[k * PARAMS_N + j] * (uint32_t)b[j * PARAMS_NBAR + i]);
             }
             out[k * PARAMS_NBAR + i] = (uint32_t)(out[k * PARAMS_NBAR + i]) & ((1 << PARAMS_LOGQ) - 1);
         }
diff --git a/crypto_kem/frodokem976shake/opt/util.c b/crypto_kem/frodokem976shake/opt/util.c
index 83677f28..f3ec5756 100644
--- a/crypto_kem/frodokem976shake/opt/util.c
+++ b/crypto_kem/frodokem976shake/opt/util.c
@@ -58,7 +58,7 @@ void PQCLEAN_FRODOKEM976SHAKE_OPT_mul_add_sb_plus_e(uint16_t *out, const uint16_
         for (i = 0; i < PARAMS_NBAR; i++) {
             out[k * PARAMS_NBAR + i] = e[k * PARAMS_NBAR + i];
             for (j = 0; j < PARAMS_N; j++) {
-                out[k * PARAMS_NBAR + i] += s[k * PARAMS_N + j] * b[j * PARAMS_NBAR + i];
+                out[k * PARAMS_NBAR + i] += (uint16_t)(s[k * PARAMS_N + j] * (uint32_t)b[j * PARAMS_NBAR + i]);
             }
             out[k * PARAMS_NBAR + i] = (uint32_t)(out[k * PARAMS_NBAR + i]) & ((1 << PARAMS_LOGQ) - 1);
         }