fix: correct AES-CTR counter byte mask from 0xf to 0xff in _parseBigEndian

lib/src/impl_ffi/impl_ffi.aesctr.dart

@@ -44,7 +44,7 @@ BigInt _parseBigEndian(List<int> data, [int? bitLength]) {
   // Parse BigInt as big-endian integer.
   var value = BigInt.from(0);
   for (var i = init; i < data.length; i++) {
-    value = (value << 8) | BigInt.from(data[i] & 0xf);
+    value = (value << 8) | BigInt.from(data[i] & 0xff);
   }
   return value;
 }

test/aes_ctr_counter_wrap_test.dart

@@ -0,0 +1,40 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//      http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import 'dart:typed_data';
+
+import 'package:test/test.dart';
+import 'package:webcrypto/webcrypto.dart';
+
+void main() {
+  test('AES-CTR 32-bit counter wrap does not carry into nonce', () async {
+    final key = await AesCtrSecretKey.importRawKey(
+      Uint8List.fromList(List<int>.generate(16, (i) => i)),
+    );
+
+    final counterA = Uint8List(16);
+    counterA[12] = 0xff;
+    counterA[13] = 0xff;
+    counterA[14] = 0xff;
+    counterA[15] = 0xff;
+
+    final counterB = Uint8List(16);
+    counterB[11] = 0x01;
+
+    final ciphertextA = await key.encryptBytes(Uint8List(32), counterA, 32);
+    final ciphertextB = await key.encryptBytes(Uint8List(16), counterB, 32);
+
+    expect(ciphertextA.sublist(16, 32), isNot(equals(ciphertextB)));
+  });
+}