panic("crypto/cipher: incorrect nonce length given to GCM") } counter := byteorder.BEUint64(nonce[len(nonce)-8:]) if !g.ready { // In the first call, the counter is zero, so we learn the XOR mask. g.ready = true g.mask = counter } counter ^= g.mask // Ensure the counter is monotonically increasing. if counter == math.MaxUint64 { panic("crypto/cipher: counter wrapped") } if counter < g.next { panic("crypto/cipher: counter decreased") } g.next = counter + 1 fips140.RecordApproved() return g.g.sealAfterIndicator(dst,...

byteorder.BEUint32(nonce[:4]) { panic("crypto/cipher: GCM nonce prefix changed") } counter := byteorder.BEUint64(nonce[len(nonce)-8:]) if !g.startReady { // The first invocation sets the starting counter, if not fixed. g.startReady = true g.start = counter } counter -= g.start // Ensure the counter is strictly increasing. if counter == math.MaxUint64 { panic("crypto/cipher: counter exhausted") } if counter < g.next { panic("crypto/cipher: counter decreased or remained the same") } g.next = counter + 1 } fips140.RecordApproved()...

*   Fixes a null pointer dereference in `CompressElement`
    ([CVE-2021-37637](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37637))
*   Fixes a null pointer dereference in `RaggedTensorToTensor`
    ([CVE-2021-37638](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-37638))
*   Fixes a null pointer dereference and a heap OOB read arising from operations
    restoring tensors