34 	size_t u, xlen, hash_len;  in br_rsa_pss_sig_unpad()  local
66 	xlen = (n_bitlen + 7) >> 3;  in br_rsa_pss_sig_unpad()
72 	if (hash_len > xlen || salt_len > xlen  in br_rsa_pss_sig_unpad()
73 		|| (hash_len + salt_len + 2) > xlen)  in br_rsa_pss_sig_unpad()
81 	r |= x[xlen - 1] ^ 0xBC;  in br_rsa_pss_sig_unpad()
87 	seed = x + xlen - hash_len - 1;  in br_rsa_pss_sig_unpad()
88 	br_mgf1_xor(x, xlen - hash_len - 1, hf_mgf1, seed, hash_len);  in br_rsa_pss_sig_unpad()
96 	for (u = 0; u < (xlen - hash_len - salt_len - 2); u ++) {  in br_rsa_pss_sig_unpad()
99 	r |= x[xlen - hash_len - salt_len - 2] ^ 0x01;  in br_rsa_pss_sig_unpad()
104 	salt = x + xlen - hash_len - salt_len - 1;  in br_rsa_pss_sig_unpad()
117 		r |= tmp[u] ^ x[(xlen - hash_len - 1) + u];  in br_rsa_pss_sig_unpad()