Fix out-of-bound (OOB) input read in AES-XTS Decrypt in AVX-512 implementation

[nebeid]

Issues:

Resolves #V1681992550

Description of changes:

• Fix instruction that caused out-of-bound read in the input reading of the 16x loop (which processes a batch of 16 blocks of AES, 1 block = 16 bytes). This was triggered on lengths that are in the range [16k * (16 bytes), (16k +3)* (16 bytes)-1], k = 1, 2, ... The instruction was reading up to 3*16 bytes beyond the input length bound.

• The fix was inspired by the 8x loop in

  aws-lc/crypto/fipsmodule/aes/asm/aesni-xts-avx512.pl

  Line 2544 in becf578

  vmovdqu8 0x70($input),%xmm5

• The existing unit tests cover those cases but there were no explicit memory protections and ASAN doesn't instrument assembly code to check for out-of-bound reads even when the contiguous memory is explicitly poisoned.

• The OOB read existed only on the decrypt path which rereads the last block when looping over 16 blocks (and over 8 blocks, but the instruction in the 8x case linked above didn't over-read) .

Call-outs:

N/A

Testing:

• The existing unit tests exercised the OOB read but no existing tools can test it; Valgrind doesn't support AVX-512 yet and ASAN doesn't instrument assembly code.
• We added explicit memory protection tests and proved they catch the error:
  On c6i, without the fix, the unit test segfaults

./crypto/crypto_test "--gtest_filter=XTSTest.*"
Note: Google Test filter = XTSTest.*
[==========] Running 4 tests from 1 test suite.
[----------] Global test environment set-up.
[----------] 4 tests from XTSTest
[ RUN      ] XTSTest.TestVectors
Segmentation fault (core dumped)

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 79.05%. Comparing base (50e6d59) to head (059bc86).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2227   +/-   ##
=======================================
  Coverage   79.05%   79.05%           
=======================================
  Files         612      612           
  Lines      106476   106483    +7     
  Branches    15051    15050    -1     
=======================================
+ Hits        84177    84184    +7     
- Misses      21646    21647    +1     
+ Partials      653      652    -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.