grpc 0.13.1 → 0.14.1.pre1

data/third_party/boringssl/crypto/curve25519/internal.h

@@ -0,0 +1,45 @@
+/* Copyright (c) 2015, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#ifndef OPENSSL_HEADER_CURVE25519_INTERNAL_H
+#define OPENSSL_HEADER_CURVE25519_INTERNAL_H
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+#if defined(OPENSSL_X86_64) && !defined(OPENSSL_SMALL) && \
+    !defined(OPENSSL_WINDOWS) && !defined(OPENSSL_NO_ASM)
+#define BORINGSSL_X25519_X86_64
+
+void x25519_x86_64(uint8_t out[32], const uint8_t scalar[32],
+                   const uint8_t point[32]);
+#endif
+
+
+#if defined(OPENSSL_ARM) && !defined(OPENSSL_NO_ASM)
+#define BORINGSSL_X25519_NEON
+
+/* x25519_NEON is defined in asm/x25519-arm.S. */
+void x25519_NEON(uint8_t out[32], const uint8_t scalar[32],
+                 const uint8_t point[32]);
+#endif
+
+
+#if defined(__cplusplus)
+}  /* extern C */
+#endif
+
+#endif  /* OPENSSL_HEADER_CURVE25519_INTERNAL_H */

data/third_party/boringssl/crypto/curve25519/x25519-x86_64.c

@@ -0,0 +1,225 @@
+#include <openssl/curve25519.h>
+
+#include <string.h>
+
+#include "internal.h"
+
+
+#if defined(BORINGSSL_X25519_X86_64)
+
+typedef struct { uint64_t v[5]; } fe25519;
+
+/* These functions are defined in asm/x25519-x86_64.S */
+void x25519_x86_64_work_cswap(fe25519 *, uint64_t);
+void x25519_x86_64_mul(fe25519 *out, const fe25519 *a, const fe25519 *b);
+void x25519_x86_64_square(fe25519 *out, const fe25519 *a);
+void x25519_x86_64_freeze(fe25519 *);
+void x25519_x86_64_ladderstep(fe25519 *work);
+
+static void fe25519_setint(fe25519 *r, unsigned v) {
+  r->v[0] = v;
+  r->v[1] = 0;
+  r->v[2] = 0;
+  r->v[3] = 0;
+  r->v[4] = 0;
+}
+
+/* Assumes input x being reduced below 2^255 */
+static void fe25519_pack(unsigned char r[32], const fe25519 *x) {
+  fe25519 t;
+  t = *x;
+  x25519_x86_64_freeze(&t);
+
+  r[0] = (uint8_t)(t.v[0] & 0xff);
+  r[1] = (uint8_t)((t.v[0] >> 8) & 0xff);
+  r[2] = (uint8_t)((t.v[0] >> 16) & 0xff);
+  r[3] = (uint8_t)((t.v[0] >> 24) & 0xff);
+  r[4] = (uint8_t)((t.v[0] >> 32) & 0xff);
+  r[5] = (uint8_t)((t.v[0] >> 40) & 0xff);
+  r[6] = (uint8_t)((t.v[0] >> 48));
+
+  r[6] ^= (uint8_t)((t.v[1] << 3) & 0xf8);
+  r[7] = (uint8_t)((t.v[1] >> 5) & 0xff);
+  r[8] = (uint8_t)((t.v[1] >> 13) & 0xff);
+  r[9] = (uint8_t)((t.v[1] >> 21) & 0xff);
+  r[10] = (uint8_t)((t.v[1] >> 29) & 0xff);
+  r[11] = (uint8_t)((t.v[1] >> 37) & 0xff);
+  r[12] = (uint8_t)((t.v[1] >> 45));
+
+  r[12] ^= (uint8_t)((t.v[2] << 6) & 0xc0);
+  r[13] = (uint8_t)((t.v[2] >> 2) & 0xff);
+  r[14] = (uint8_t)((t.v[2] >> 10) & 0xff);
+  r[15] = (uint8_t)((t.v[2] >> 18) & 0xff);
+  r[16] = (uint8_t)((t.v[2] >> 26) & 0xff);
+  r[17] = (uint8_t)((t.v[2] >> 34) & 0xff);
+  r[18] = (uint8_t)((t.v[2] >> 42) & 0xff);
+  r[19] = (uint8_t)((t.v[2] >> 50));
+
+  r[19] ^= (uint8_t)((t.v[3] << 1) & 0xfe);
+  r[20] = (uint8_t)((t.v[3] >> 7) & 0xff);
+  r[21] = (uint8_t)((t.v[3] >> 15) & 0xff);
+  r[22] = (uint8_t)((t.v[3] >> 23) & 0xff);
+  r[23] = (uint8_t)((t.v[3] >> 31) & 0xff);
+  r[24] = (uint8_t)((t.v[3] >> 39) & 0xff);
+  r[25] = (uint8_t)((t.v[3] >> 47));
+
+  r[25] ^= (uint8_t)((t.v[4] << 4) & 0xf0);
+  r[26] = (uint8_t)((t.v[4] >> 4) & 0xff);
+  r[27] = (uint8_t)((t.v[4] >> 12) & 0xff);
+  r[28] = (uint8_t)((t.v[4] >> 20) & 0xff);
+  r[29] = (uint8_t)((t.v[4] >> 28) & 0xff);
+  r[30] = (uint8_t)((t.v[4] >> 36) & 0xff);
+  r[31] = (uint8_t)((t.v[4] >> 44));
+}
+
+static void fe25519_unpack(fe25519 *r, const uint8_t x[32]) {
+  r->v[0] = x[0];
+  r->v[0] += (uint64_t)x[1] << 8;
+  r->v[0] += (uint64_t)x[2] << 16;
+  r->v[0] += (uint64_t)x[3] << 24;
+  r->v[0] += (uint64_t)x[4] << 32;
+  r->v[0] += (uint64_t)x[5] << 40;
+  r->v[0] += ((uint64_t)x[6] & 7) << 48;
+
+  r->v[1] = x[6] >> 3;
+  r->v[1] += (uint64_t)x[7] << 5;
+  r->v[1] += (uint64_t)x[8] << 13;
+  r->v[1] += (uint64_t)x[9] << 21;
+  r->v[1] += (uint64_t)x[10] << 29;
+  r->v[1] += (uint64_t)x[11] << 37;
+  r->v[1] += ((uint64_t)x[12] & 63) << 45;
+
+  r->v[2] = x[12] >> 6;
+  r->v[2] += (uint64_t)x[13] << 2;
+  r->v[2] += (uint64_t)x[14] << 10;
+  r->v[2] += (uint64_t)x[15] << 18;
+  r->v[2] += (uint64_t)x[16] << 26;
+  r->v[2] += (uint64_t)x[17] << 34;
+  r->v[2] += (uint64_t)x[18] << 42;
+  r->v[2] += ((uint64_t)x[19] & 1) << 50;
+
+  r->v[3] = x[19] >> 1;
+  r->v[3] += (uint64_t)x[20] << 7;
+  r->v[3] += (uint64_t)x[21] << 15;
+  r->v[3] += (uint64_t)x[22] << 23;
+  r->v[3] += (uint64_t)x[23] << 31;
+  r->v[3] += (uint64_t)x[24] << 39;
+  r->v[3] += ((uint64_t)x[25] & 15) << 47;
+
+  r->v[4] = x[25] >> 4;
+  r->v[4] += (uint64_t)x[26] << 4;
+  r->v[4] += (uint64_t)x[27] << 12;
+  r->v[4] += (uint64_t)x[28] << 20;
+  r->v[4] += (uint64_t)x[29] << 28;
+  r->v[4] += (uint64_t)x[30] << 36;
+  r->v[4] += ((uint64_t)x[31] & 127) << 44;
+}
+
+static void fe25519_invert(fe25519 *r, const fe25519 *x) {
+  fe25519 z2;
+  fe25519 z9;
+  fe25519 z11;
+  fe25519 z2_5_0;
+  fe25519 z2_10_0;
+  fe25519 z2_20_0;
+  fe25519 z2_50_0;
+  fe25519 z2_100_0;
+  fe25519 t;
+  int i;
+
+  /* 2 */ x25519_x86_64_square(&z2, x);
+  /* 4 */ x25519_x86_64_square(&t, &z2);
+  /* 8 */ x25519_x86_64_square(&t, &t);
+  /* 9 */ x25519_x86_64_mul(&z9, &t, x);
+  /* 11 */ x25519_x86_64_mul(&z11, &z9, &z2);
+  /* 22 */ x25519_x86_64_square(&t, &z11);
+  /* 2^5 - 2^0 = 31 */ x25519_x86_64_mul(&z2_5_0, &t, &z9);
+
+  /* 2^6 - 2^1 */ x25519_x86_64_square(&t, &z2_5_0);
+  /* 2^20 - 2^10 */ for (i = 1; i < 5; i++) { x25519_x86_64_square(&t, &t); }
+  /* 2^10 - 2^0 */ x25519_x86_64_mul(&z2_10_0, &t, &z2_5_0);
+
+  /* 2^11 - 2^1 */ x25519_x86_64_square(&t, &z2_10_0);
+  /* 2^20 - 2^10 */ for (i = 1; i < 10; i++) { x25519_x86_64_square(&t, &t); }
+  /* 2^20 - 2^0 */ x25519_x86_64_mul(&z2_20_0, &t, &z2_10_0);
+
+  /* 2^21 - 2^1 */ x25519_x86_64_square(&t, &z2_20_0);
+  /* 2^40 - 2^20 */ for (i = 1; i < 20; i++) { x25519_x86_64_square(&t, &t); }
+  /* 2^40 - 2^0 */ x25519_x86_64_mul(&t, &t, &z2_20_0);
+
+  /* 2^41 - 2^1 */ x25519_x86_64_square(&t, &t);
+  /* 2^50 - 2^10 */ for (i = 1; i < 10; i++) { x25519_x86_64_square(&t, &t); }
+  /* 2^50 - 2^0 */ x25519_x86_64_mul(&z2_50_0, &t, &z2_10_0);
+
+  /* 2^51 - 2^1 */ x25519_x86_64_square(&t, &z2_50_0);
+  /* 2^100 - 2^50 */ for (i = 1; i < 50; i++) { x25519_x86_64_square(&t, &t); }
+  /* 2^100 - 2^0 */ x25519_x86_64_mul(&z2_100_0, &t, &z2_50_0);
+
+  /* 2^101 - 2^1 */ x25519_x86_64_square(&t, &z2_100_0);
+  /* 2^200 - 2^100 */ for (i = 1; i < 100; i++) {
+    x25519_x86_64_square(&t, &t);
+  }
+  /* 2^200 - 2^0 */ x25519_x86_64_mul(&t, &t, &z2_100_0);
+
+  /* 2^201 - 2^1 */ x25519_x86_64_square(&t, &t);
+  /* 2^250 - 2^50 */ for (i = 1; i < 50; i++) { x25519_x86_64_square(&t, &t); }
+  /* 2^250 - 2^0 */ x25519_x86_64_mul(&t, &t, &z2_50_0);
+
+  /* 2^251 - 2^1 */ x25519_x86_64_square(&t, &t);
+  /* 2^252 - 2^2 */ x25519_x86_64_square(&t, &t);
+  /* 2^253 - 2^3 */ x25519_x86_64_square(&t, &t);
+
+  /* 2^254 - 2^4 */ x25519_x86_64_square(&t, &t);
+
+  /* 2^255 - 2^5 */ x25519_x86_64_square(&t, &t);
+  /* 2^255 - 21 */ x25519_x86_64_mul(r, &t, &z11);
+}
+
+static void mladder(fe25519 *xr, fe25519 *zr, const uint8_t s[32]) {
+  fe25519 work[5];
+
+  work[0] = *xr;
+  fe25519_setint(work + 1, 1);
+  fe25519_setint(work + 2, 0);
+  work[3] = *xr;
+  fe25519_setint(work + 4, 1);
+
+  int i, j;
+  uint8_t prevbit = 0;
+
+  j = 6;
+  for (i = 31; i >= 0; i--) {
+    while (j >= 0) {
+      const uint8_t bit = 1 & (s[i] >> j);
+      const uint64_t swap = bit ^ prevbit;
+      prevbit = bit;
+      x25519_x86_64_work_cswap(work + 1, swap);
+      x25519_x86_64_ladderstep(work);
+      j -= 1;
+    }
+    j = 7;
+  }
+
+  *xr = work[1];
+  *zr = work[2];
+}
+
+void x25519_x86_64(uint8_t out[32], const uint8_t scalar[32],
+                  const uint8_t point[32]) {
+  uint8_t e[32];
+  memcpy(e, scalar, sizeof(e));
+
+  e[0] &= 248;
+  e[31] &= 127;
+  e[31] |= 64;
+
+  fe25519 t;
+  fe25519 z;
+  fe25519_unpack(&t, point);
+  mladder(&t, &z, e);
+  fe25519_invert(&z, &z);
+  x25519_x86_64_mul(&t, &t, &z);
+  fe25519_pack(out, &t);
+}
+
+#endif  /* BORINGSSL_X25519_X86_64 */

data/third_party/boringssl/crypto/dh/check.c

@@ -62,30 +62,52 @@
 
 
 int DH_check_pub_key(const DH *dh, const BIGNUM *pub_key, int *ret) {
+  *ret = 0;
+
+  BN_CTX *ctx = BN_CTX_new();
+  if (ctx == NULL) {
+    return 0;
+  }
+  BN_CTX_start(ctx);
+
   int ok = 0;
-  BIGNUM q;
 
-  *ret = 0;
-  BN_init(&q);
-  if (!BN_set_word(&q, 1)) {
+  /* Check |pub_key| is greater than 1. */
+  BIGNUM *tmp = BN_CTX_get(ctx);
+  if (tmp == NULL ||
+      !BN_set_word(tmp, 1)) {
     goto err;
   }
-
-  if (BN_cmp(pub_key, &q) <= 0) {
+  if (BN_cmp(pub_key, tmp) <= 0) {
     *ret |= DH_CHECK_PUBKEY_TOO_SMALL;
   }
-  if (!BN_copy(&q, dh->p) ||
-      !BN_sub_word(&q, 1)) {
+
+  /* Check |pub_key| is less than |dh->p| - 1. */
+  if (!BN_copy(tmp, dh->p) ||
+      !BN_sub_word(tmp, 1)) {
     goto err;
   }
-  if (BN_cmp(pub_key, &q) >= 0) {
+  if (BN_cmp(pub_key, tmp) >= 0) {
     *ret |= DH_CHECK_PUBKEY_TOO_LARGE;
   }
 
+  if (dh->q != NULL) {
+    /* Check |pub_key|^|dh->q| is 1 mod |dh->p|. This is necessary for RFC 5114
+     * groups which are not safe primes but pick a generator on a prime-order
+     * subgroup of size |dh->q|. */
+    if (!BN_mod_exp(tmp, pub_key, dh->q, dh->p, ctx)) {
+      goto err;
+    }
+    if (!BN_is_one(tmp)) {
+      *ret |= DH_CHECK_PUBKEY_INVALID;
+    }
+  }
+
   ok = 1;
 
 err:
-  BN_free(&q);
+  BN_CTX_end(ctx);
+  BN_CTX_free(ctx);
   return ok;
 }
 

data/third_party/boringssl/crypto/dh/dh.c

@@ -74,7 +74,7 @@
 static CRYPTO_EX_DATA_CLASS g_ex_data_class = CRYPTO_EX_DATA_CLASS_INIT;
 
 DH *DH_new(void) {
-  DH *dh = (DH *)OPENSSL_malloc(sizeof(DH));
+  DH *dh = OPENSSL_malloc(sizeof(DH));
   if (dh == NULL) {
     OPENSSL_PUT_ERROR(DH, ERR_R_MALLOC_FAILURE);
     return NULL;

data/third_party/boringssl/crypto/digest/md32_common.h

@@ -140,89 +140,29 @@ extern "C" {
 
 #if defined(DATA_ORDER_IS_BIG_ENDIAN)
 
-#if !defined(PEDANTIC) && defined(__GNUC__) && __GNUC__ >= 2 && \
-    !defined(OPENSSL_NO_ASM)
-#if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
-/* The first macro gives a ~30-40% performance improvement in SHA-256 compiled
- * with gcc on P4. This can only be done on x86, where unaligned data fetches
- * are possible. */
-#define HOST_c2l(c, l)                       \
-  (void)({                                   \
-    uint32_t r = *((const uint32_t *)(c));   \
-    __asm__("bswapl %0" : "=r"(r) : "0"(r)); \
-    (c) += 4;                                \
-    (l) = r;                                 \
-  })
-#define HOST_l2c(l, c)                       \
-  (void)({                                   \
-    uint32_t r = (l);                        \
-    __asm__("bswapl %0" : "=r"(r) : "0"(r)); \
-    *((uint32_t *)(c)) = r;                  \
-    (c) += 4;                                \
-    r;                                       \
-  })
-#elif defined(__aarch64__) && defined(__BYTE_ORDER__)
-#if defined(__ORDER_LITTLE_ENDIAN__) && \
-    __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__
-#define HOST_c2l(c, l)                                                 \
-  (void)({                                                             \
-    uint32_t r;                                                        \
-    __asm__("rev %w0, %w1" : "=r"(r) : "r"(*((const uint32_t *)(c)))); \
-    (c) += 4;                                                          \
-    (l) = r;                                                           \
-  })
-#define HOST_l2c(l, c)                                      \
-  (void)({                                                  \
-    uint32_t r;                                             \
-    __asm__("rev %w0, %w1" : "=r"(r) : "r"((uint32_t)(l))); \
-    *((uint32_t *)(c)) = r;                                 \
-    (c) += 4;                                               \
-    r;                                                      \
-  })
-#elif defined(__ORDER_BIG_ENDIAN__) && __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
-#define HOST_c2l(c, l) (void)((l) = *((const uint32_t *)(c)), (c) += 4)
-#define HOST_l2c(l, c) (*((uint32_t *)(c)) = (l), (c) += 4, (l))
-#endif /* __aarch64__ && __BYTE_ORDER__ */
-#endif /* ARCH */
-#endif /* !PEDANTIC && GNUC && !NO_ASM */
-
-#ifndef HOST_c2l
 #define HOST_c2l(c, l)                        \
   (void)(l = (((uint32_t)(*((c)++))) << 24),  \
          l |= (((uint32_t)(*((c)++))) << 16), \
          l |= (((uint32_t)(*((c)++))) << 8), l |= (((uint32_t)(*((c)++)))))
-#endif
 
-#ifndef HOST_l2c
 #define HOST_l2c(l, c)                             \
   (void)(*((c)++) = (uint8_t)(((l) >> 24) & 0xff), \
          *((c)++) = (uint8_t)(((l) >> 16) & 0xff), \
          *((c)++) = (uint8_t)(((l) >> 8) & 0xff),  \
          *((c)++) = (uint8_t)(((l)) & 0xff))
-#endif
 
 #elif defined(DATA_ORDER_IS_LITTLE_ENDIAN)
 
-#if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
-/* See comment in DATA_ORDER_IS_BIG_ENDIAN section. */
-#define HOST_c2l(c, l) (void)((l) = *((const uint32_t *)(c)), (c) += 4)
-#define HOST_l2c(l, c) (void)(*((uint32_t *)(c)) = (l), (c) += 4, l)
-#endif /* OPENSSL_X86 || OPENSSL_X86_64 */
-
-#ifndef HOST_c2l
 #define HOST_c2l(c, l)                                                     \
   (void)(l = (((uint32_t)(*((c)++)))), l |= (((uint32_t)(*((c)++))) << 8), \
          l |= (((uint32_t)(*((c)++))) << 16),                              \
          l |= (((uint32_t)(*((c)++))) << 24))
-#endif
 
-#ifndef HOST_l2c
 #define HOST_l2c(l, c)                             \
   (void)(*((c)++) = (uint8_t)(((l)) & 0xff),       \
          *((c)++) = (uint8_t)(((l) >> 8) & 0xff),  \
          *((c)++) = (uint8_t)(((l) >> 16) & 0xff), \
          *((c)++) = (uint8_t)(((l) >> 24) & 0xff))
-#endif
 
 #endif /* DATA_ORDER */
 

data/third_party/boringssl/crypto/dsa/dsa.c

@@ -61,7 +61,6 @@
 
 #include <string.h>
 
-#include <openssl/asn1.h>
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 #include <openssl/digest.h>
@@ -73,7 +72,6 @@
 #include <openssl/sha.h>
 #include <openssl/thread.h>
 
-#include "internal.h"
 #include "../internal.h"
 
 
@@ -86,7 +84,7 @@
 static CRYPTO_EX_DATA_CLASS g_ex_data_class = CRYPTO_EX_DATA_CLASS_INIT;
 
 DSA *DSA_new(void) {
-  DSA *dsa = (DSA *)OPENSSL_malloc(sizeof(DSA));
+  DSA *dsa = OPENSSL_malloc(sizeof(DSA));
   if (dsa == NULL) {
     OPENSSL_PUT_ERROR(DSA, ERR_R_MALLOC_FAILURE);
     return NULL;
@@ -94,7 +92,6 @@ DSA *DSA_new(void) {
 
   memset(dsa, 0, sizeof(DSA));
 
-  dsa->write_params = 1;
   dsa->references = 1;
 
   CRYPTO_MUTEX_init(&dsa->method_mont_p_lock);
@@ -393,6 +390,21 @@ err:
   return ok;
 }
 
+DSA *DSAparams_dup(const DSA *dsa) {
+  DSA *ret = DSA_new();
+  if (ret == NULL) {
+    return NULL;
+  }
+  ret->p = BN_dup(dsa->p);
+  ret->q = BN_dup(dsa->q);
+  ret->g = BN_dup(dsa->g);
+  if (ret->p == NULL || ret->q == NULL || ret->g == NULL) {
+    DSA_free(ret);
+    return NULL;
+  }
+  return ret;
+}
+
 int DSA_generate_key(DSA *dsa) {
   int ok = 0;
   BN_CTX *ctx = NULL;
@@ -740,24 +752,38 @@ err:
   return ret;
 }
 
-int DSA_size(const DSA *dsa) {
-  int ret, i;
-  ASN1_INTEGER bs;
-  unsigned char buf[4]; /* 4 bytes looks really small.
-                           However, i2d_ASN1_INTEGER() will not look
-                           beyond the first byte, as long as the second
-                           parameter is NULL. */
+/* der_len_len returns the number of bytes needed to represent a length of |len|
+ * in DER. */
+static size_t der_len_len(size_t len) {
+  if (len < 0x80) {
+    return 1;
+  }
+  size_t ret = 1;
+  while (len > 0) {
+    ret++;
+    len >>= 8;
+  }
+  return ret;
+}
 
-  i = BN_num_bits(dsa->q);
-  bs.length = (i + 7) / 8;
-  bs.data = buf;
-  bs.type = V_ASN1_INTEGER;
-  /* If the top bit is set the asn1 encoding is 1 larger. */
-  buf[0] = 0xff;
-
-  i = i2d_ASN1_INTEGER(&bs, NULL);
-  i += i; /* r and s */
-  ret = ASN1_object_size(1, i, V_ASN1_SEQUENCE);
+int DSA_size(const DSA *dsa) {
+  size_t order_len = BN_num_bytes(dsa->q);
+  /* Compute the maximum length of an |order_len| byte integer. Defensively
+   * assume that the leading 0x00 is included. */
+  size_t integer_len = 1 /* tag */ + der_len_len(order_len + 1) + 1 + order_len;
+  if (integer_len < order_len) {
+    return 0;
+  }
+  /* A DSA signature is two INTEGERs. */
+  size_t value_len = 2 * integer_len;
+  if (value_len < integer_len) {
+    return 0;
+  }
+  /* Add the header. */
+  size_t ret = 1 /* tag */ + der_len_len(value_len) + value_len;
+  if (ret < value_len) {
+    return 0;
+  }
   return ret;
 }