in src/gcm.c [116:133]
static void GCM_wrap(gcm *g)
{
/* Finish off GHASH */
int i;
int j;
unsign32 F[4];
uchar L[16];
/* convert lengths from bytes to bits */
F[0]=(g->lenA[0]<<3)|(g->lenA[1]&0xE0000000)>>29;
F[1]=g->lenA[1]<<3;
F[2]=(g->lenC[0]<<3)|(g->lenC[1]&0xE0000000)>>29;
F[3]=g->lenC[1]<<3;
for (i=j=0; i<NB; i++,j+=4) unpack(F[i],&L[j]);
for (i=0; i<16; i++) g->stateX[i]^=L[i];
gf2mul(g);
}