(cherry picked from commit 3caeef94)

(cherry picked from commit f93a4187)

(cherry picked from commit e9baceab)

With previous commit it also ensures that valgrind is happy.

Fix the calculation that checks there is enough room in a record
after removing padding and optional explicit IV. (by Steve)

For AEAD remove the correct number of padding bytes (by Andy)

MD5 should use little endian order. Fortunately the only ciphersuite
affected is EXP-RC2-CBC-MD5 (TLS_RSA_EXPORT_WITH_RC2_CBC_40_MD5) which
is a rarely used export grade ciphersuite.

(cherry picked from commit 134c0065)

PR: 2963 and a number of others
(cherry picked from commit 4568182a)

Address CBC decrypt timing issues and reenable the AESNI+SHA1 stitch.

Kludge alert. This is arranged by passing padding length in unused
bits of SSL3_RECORD->type, so that orig_len can be reconstructed.

RISCs are picky and alignment granted by compiler for md_state can be
insufficient for SHA512.

Break dependency on uint64_t. It's possible to declare bits as
unsigned int, because TLS packets are limited in size and 32-bit
value can't overflow.

branches it needs to be in a "gap".

We have to use EVP in FIPS mode so we can only partially mitigate
timing differences.

Make an extra call to EVP_DigestSignUpdate to hash additonal blocks
to cover any timing differences caused by removal of padding.

Add additional check to catch this in ASN1_item_verify too.