Endian or alignment bugs in poly1305 code?

[richfelker]

I'm getting correct encryption but wrong tag output on a big endian system without support for misaligned loads or stores. Haven't tracked down the cause yet. I'm not building with USE_UNALIGNED and the code looks correct in that case, but apparently it's not. I can provide the output with test vectors if needed.

[richfelker]

Found the bug: the poly1305_get_tag function in chachapoly.c wrongly uses (unsigned char *)&len in an attempt to access the little endian encoding of length. It needs to use a proper U32TO8 construct like everywhere else.

[doggodanubus]

@richfelker Could provide a fixed snippet or diff? Thanks.