Split fe_set_b32 into reducing and normalizing variants #1207

 383 | +        r->magnitude = 1;
 384 | +        r->normalized = 1;
 385 | +        secp256k1_fe_verify(r);
 386 | +    } else {
 387 | +        r->n[4] ^= 1; /* change value, hopefully triggering errors if the value is used. */
 388 | +    }

---

  74 | @@ -75,10 +75,14 @@ static int secp256k1_fe_equal_var(const secp256k1_fe *a, const secp256k1_fe *b);
  75 |  /** Compare two field elements. Requires both inputs to be normalized */
  76 |  static int secp256k1_fe_cmp_var(const secp256k1_fe *a, const secp256k1_fe *b);
  77 |  
  78 | -/** Set a field element equal to 32-byte big endian value.
  79 | - *  Returns 1 if no overflow occurred, and then the output is normalized.
  80 | - *  Returns 0 if overflow occurred, and then the output is only weakly normalized. */
  81 | -static int secp256k1_fe_set_b32(secp256k1_fe *r, const unsigned char *a);
  82 | +/** Set a field element equal to 32-byte big endian value, reducing modulo the curve
  83 | + *  order if need be. The output is weakly normalized. */

---

 204 |   *
 205 | - * Note that this function is unusual in that the normalization of the output depends on the
 206 | - * run-time value of a.
 207 | + * On input, r does not need to be initalized. a must be a pointer to an initialized 32-byte array.
 208 | + * On output, r = a if (a < p), it will be normalized with magnitude 1, and 1 is returned.
 209 | + * If a >= 0, 0 is returned, and r will be made invalid (and cannot be used without overwriting).

---