Address the TODO from the "extra 5 bytes" commit above

Now the count is correct even when pub_in > 1

Enclave/route.cpp

@@ -833,11 +833,24 @@ static uint32_t send_round1b_msgs(const uint8_t *msgs, uint32_t N) {
             next_receiver_id = *(const uint32_t *)(msgs +
                 num_msgs * msg_size);
             next_rid_count = 1;
+
+            // If pub_in > 1, obliviously scan messages num_msgs+1 ..
+            // num_msgs+(pub_in-1) and as long as they have the same
+            // receiver id as next_receiver_id, add 1 to next_rid_count (but
+            // don't go past message N of course)
+
+            // This count _includes_ the first message already scanned
+            // above.  It is not private.
+            uint8_t num_to_scan = uint8_t(std::min(N - num_msgs,
+                uint32_t(g_teems_config.m_pub_in)));
+            const unsigned char *scan_msg = msgs +
+                (num_msgs + 1) * msg_size;
+            for (uint8_t i=1; i<num_to_scan; ++i) {
+                uint32_t receiver_id = *(const uint32_t *)scan_msg;
+                next_rid_count += (receiver_id == next_receiver_id);
+                scan_msg += msg_size;
+            }
         }
-        // TODO: If pub_in > 1, obliviously scan messages num_msgs+1 ..
-        // num_msgs+(pub_in-1) and as long as they have the same
-        // receiver id as next_receiver_id, add 1 to next_rid_count (but
-        // don't go past message N of course)
         nodecom.message_data((const unsigned char *)&next_receiver_id, 4);
         nodecom.message_data(&next_rid_count, 1);
         return num_msgs;