in src/gcm.c [250:279]
int GCM_add_cipher(gcm *g,char *plain,const char *cipher,int len)
{
/* Add ciphertext to extract plaintext, len is length of ciphertext. */
int j=0;
unsign32 counter;
char oc;
uchar B[16];
if (g->status==GCM_ACCEPTING_HEADER) g->status=GCM_ACCEPTING_CIPHER;
if (g->status!=GCM_ACCEPTING_CIPHER) return 0;
while (j<len)
{
counter=pack((uchar *)&(g->a.f[12]));
counter++;
unpack(counter,(uchar *)&(g->a.f[12])); /* increment counter */
for (int i=0; i<16; i++) B[i]=g->a.f[i];
AES_ecb_encrypt(&(g->a),B); /* encrypt it */
for (int i=0; i<16 && j<len; i++,j++)
{
oc=cipher[j];
plain[j]=(char)(cipher[j]^B[i]);
g->stateX[i]^=oc;
g->lenC[1]++;
if (g->lenC[1]==0) g->lenC[0]++;
}
gf2mul(g);
}
if (len%16!=0) g->status=GCM_NOT_ACCEPTING_MORE;
return 1;
}