grpc 1.24.0 → 1.25.0

data/third_party/boringssl/crypto/fipsmodule/bn/cmp.c

@@ -65,8 +65,8 @@
 
 static int bn_cmp_words_consttime(const BN_ULONG *a, size_t a_len,
                                   const BN_ULONG *b, size_t b_len) {
-  OPENSSL_COMPILE_ASSERT(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
-                         crypto_word_t_too_small);
+  OPENSSL_STATIC_ASSERT(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
+                        "crypto_word_t is too small");
   int ret = 0;
   // Process the common words in little-endian order.
   size_t min = a_len < b_len ? a_len : b_len;

data/third_party/boringssl/crypto/fipsmodule/bn/ctx.c

@@ -54,6 +54,7 @@
 
 #include <openssl/bn.h>
 
+#include <assert.h>
 #include <string.h>
 
 #include <openssl/err.h>
@@ -62,63 +63,46 @@
 #include "../../internal.h"
 
 
-// How many bignums are in each "pool item";
-#define BN_CTX_POOL_SIZE 16
 // The stack frame info is resizing, set a first-time expansion size;
 #define BN_CTX_START_FRAMES 32
 
-// A bundle of bignums that can be linked with other bundles
-typedef struct bignum_pool_item {
-  // The bignum values
-  BIGNUM vals[BN_CTX_POOL_SIZE];
-  // Linked-list admin
-  struct bignum_pool_item *prev, *next;
-} BN_POOL_ITEM;
-
-
-typedef struct bignum_pool {
-  // Linked-list admin
-  BN_POOL_ITEM *head, *current, *tail;
-  // Stack depth and allocation size
-  unsigned used, size;
-} BN_POOL;
-
-static void BN_POOL_init(BN_POOL *);
-static void BN_POOL_finish(BN_POOL *);
-static BIGNUM *BN_POOL_get(BN_POOL *);
-static void BN_POOL_release(BN_POOL *, unsigned int);
-
 
 // BN_STACK
 
-// A wrapper to manage the "stack frames"
-typedef struct bignum_ctx_stack {
-  // Array of indexes into the bignum stack
-  unsigned int *indexes;
+// A |BN_STACK| is a stack of |size_t| values.
+typedef struct {
+  // Array of indexes into |ctx->bignums|.
+  size_t *indexes;
   // Number of stack frames, and the size of the allocated array
-  unsigned int depth, size;
+  size_t depth, size;
 } BN_STACK;
 
-static void		BN_STACK_init(BN_STACK *);
-static void		BN_STACK_finish(BN_STACK *);
-static int		BN_STACK_push(BN_STACK *, unsigned int);
-static unsigned int	BN_STACK_pop(BN_STACK *);
+static void BN_STACK_init(BN_STACK *);
+static void BN_STACK_cleanup(BN_STACK *);
+static int BN_STACK_push(BN_STACK *, size_t idx);
+static size_t BN_STACK_pop(BN_STACK *);
 
 
 // BN_CTX
 
+DEFINE_STACK_OF(BIGNUM)
+
 // The opaque BN_CTX type
 struct bignum_ctx {
-  // The bignum bundles
-  BN_POOL pool;
-  // The "stack frames", if you will
+  // bignums is the stack of |BIGNUM|s managed by this |BN_CTX|.
+  STACK_OF(BIGNUM) *bignums;
+  // stack is the stack of |BN_CTX_start| frames. It is the value of |used| at
+  // the time |BN_CTX_start| was called.
   BN_STACK stack;
-  // The number of bignums currently assigned
-  unsigned int used;
-  // Depth of stack overflow
-  int err_stack;
-  // Block "gets" until an "end" (compatibility behaviour)
-  int too_many;
+  // used is the number of |BIGNUM|s from |bignums| that have been used.
+  size_t used;
+  // error is one if any operation on this |BN_CTX| failed. All subsequent
+  // operations will fail.
+  char error;
+  // defer_error is one if an operation on this |BN_CTX| has failed, but no
+  // error has been pushed to the queue yet. This is used to defer errors from
+  // |BN_CTX_start| to |BN_CTX_get|.
+  char defer_error;
 };
 
 BN_CTX *BN_CTX_new(void) {
@@ -129,11 +113,11 @@ BN_CTX *BN_CTX_new(void) {
   }
 
   // Initialise the structure
-  BN_POOL_init(&ret->pool);
+  ret->bignums = NULL;
   BN_STACK_init(&ret->stack);
   ret->used = 0;
-  ret->err_stack = 0;
-  ret->too_many = 0;
+  ret->error = 0;
+  ret->defer_error = 0;
   return ret;
 }
 
@@ -142,57 +126,73 @@ void BN_CTX_free(BN_CTX *ctx) {
     return;
   }
 
-  BN_STACK_finish(&ctx->stack);
-  BN_POOL_finish(&ctx->pool);
+  // All |BN_CTX_start| calls must be matched with |BN_CTX_end|, otherwise the
+  // function may use more memory than expected, potentially without bound if
+  // done in a loop. Assert that all |BIGNUM|s have been released.
+  assert(ctx->used == 0 || ctx->error);
+  sk_BIGNUM_pop_free(ctx->bignums, BN_free);
+  BN_STACK_cleanup(&ctx->stack);
   OPENSSL_free(ctx);
 }
 
 void BN_CTX_start(BN_CTX *ctx) {
-  // If we're already overflowing ...
-  if (ctx->err_stack || ctx->too_many) {
-    ctx->err_stack++;
-  } else if (!BN_STACK_push(&ctx->stack, ctx->used)) {
-    // (Try to) get a new frame pointer
-    OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_TEMPORARY_VARIABLES);
-    ctx->err_stack++;
+  if (ctx->error) {
+    // Once an operation has failed, |ctx->stack| no longer matches the number
+    // of |BN_CTX_end| calls to come. Do nothing.
+    return;
+  }
+
+  if (!BN_STACK_push(&ctx->stack, ctx->used)) {
+    ctx->error = 1;
+    // |BN_CTX_start| cannot fail, so defer the error to |BN_CTX_get|.
+    ctx->defer_error = 1;
   }
 }
 
 BIGNUM *BN_CTX_get(BN_CTX *ctx) {
-  BIGNUM *ret;
-  if (ctx->err_stack || ctx->too_many) {
+  // Once any operation has failed, they all do.
+  if (ctx->error) {
+    if (ctx->defer_error) {
+      OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_TEMPORARY_VARIABLES);
+      ctx->defer_error = 0;
+    }
     return NULL;
   }
 
-  ret = BN_POOL_get(&ctx->pool);
-  if (ret == NULL) {
-    // Setting too_many prevents repeated "get" attempts from
-    // cluttering the error stack.
-    ctx->too_many = 1;
-    OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_TEMPORARY_VARIABLES);
-    return NULL;
+  if (ctx->bignums == NULL) {
+    ctx->bignums = sk_BIGNUM_new_null();
+    if (ctx->bignums == NULL) {
+      OPENSSL_PUT_ERROR(BN, ERR_R_MALLOC_FAILURE);
+      ctx->error = 1;
+      return NULL;
+    }
   }
 
-  // OK, make sure the returned bignum is "zero"
+  if (ctx->used == sk_BIGNUM_num(ctx->bignums)) {
+    BIGNUM *bn = BN_new();
+    if (bn == NULL || !sk_BIGNUM_push(ctx->bignums, bn)) {
+      OPENSSL_PUT_ERROR(BN, BN_R_TOO_MANY_TEMPORARY_VARIABLES);
+      BN_free(bn);
+      ctx->error = 1;
+      return NULL;
+    }
+  }
+
+  BIGNUM *ret = sk_BIGNUM_value(ctx->bignums, ctx->used);
   BN_zero(ret);
+  // This is bounded by |sk_BIGNUM_num|, so it cannot overflow.
   ctx->used++;
   return ret;
 }
 
 void BN_CTX_end(BN_CTX *ctx) {
-  if (ctx->err_stack) {
-    ctx->err_stack--;
-  } else {
-    unsigned int fp = BN_STACK_pop(&ctx->stack);
-    // Does this stack frame have anything to release?
-    if (fp < ctx->used) {
-      BN_POOL_release(&ctx->pool, ctx->used - fp);
-    }
-
-    ctx->used = fp;
-    // Unjam "too_many" in case "get" had failed
-    ctx->too_many = 0;
+  if (ctx->error) {
+    // Once an operation has failed, |ctx->stack| no longer matches the number
+    // of |BN_CTX_end| calls to come. Do nothing.
+    return;
   }
+
+  ctx->used = BN_STACK_pop(&ctx->stack);
 }
 
 
@@ -203,101 +203,34 @@ static void BN_STACK_init(BN_STACK *st) {
   st->depth = st->size = 0;
 }
 
-static void BN_STACK_finish(BN_STACK *st) {
+static void BN_STACK_cleanup(BN_STACK *st) {
   OPENSSL_free(st->indexes);
 }
 
-static int BN_STACK_push(BN_STACK *st, unsigned int idx) {
+static int BN_STACK_push(BN_STACK *st, size_t idx) {
   if (st->depth == st->size) {
-    // Need to expand
-    unsigned int newsize =
-        (st->size ? (st->size * 3 / 2) : BN_CTX_START_FRAMES);
-    unsigned int *newitems = OPENSSL_malloc(newsize * sizeof(unsigned int));
-    if (!newitems) {
+    // This function intentionally does not push to the error queue on error.
+    // Error-reporting is deferred to |BN_CTX_get|.
+    size_t new_size = st->size != 0 ? st->size * 3 / 2 : BN_CTX_START_FRAMES;
+    if (new_size <= st->size || new_size > ((size_t)-1) / sizeof(size_t)) {
       return 0;
     }
-    if (st->depth) {
-      OPENSSL_memcpy(newitems, st->indexes, st->depth * sizeof(unsigned int));
+    size_t *new_indexes =
+        OPENSSL_realloc(st->indexes, new_size * sizeof(size_t));
+    if (new_indexes == NULL) {
+      return 0;
     }
-    OPENSSL_free(st->indexes);
-    st->indexes = newitems;
-    st->size = newsize;
+    st->indexes = new_indexes;
+    st->size = new_size;
   }
 
-  st->indexes[(st->depth)++] = idx;
+  st->indexes[st->depth] = idx;
+  st->depth++;
   return 1;
 }
 
-static unsigned int BN_STACK_pop(BN_STACK *st) {
-  return st->indexes[--(st->depth)];
-}
-
-
-static void BN_POOL_init(BN_POOL *p) {
-  p->head = p->current = p->tail = NULL;
-  p->used = p->size = 0;
-}
-
-static void BN_POOL_finish(BN_POOL *p) {
-  while (p->head) {
-    for (size_t i = 0; i < BN_CTX_POOL_SIZE; i++) {
-      BN_clear_free(&p->head->vals[i]);
-    }
-
-    p->current = p->head->next;
-    OPENSSL_free(p->head);
-    p->head = p->current;
-  }
-}
-
-static BIGNUM *BN_POOL_get(BN_POOL *p) {
-  if (p->used == p->size) {
-    BN_POOL_ITEM *item = OPENSSL_malloc(sizeof(BN_POOL_ITEM));
-    if (!item) {
-      return NULL;
-    }
-
-    // Initialise the structure
-    for (size_t i = 0; i < BN_CTX_POOL_SIZE; i++) {
-      BN_init(&item->vals[i]);
-    }
-
-    item->prev = p->tail;
-    item->next = NULL;
-    // Link it in
-    if (!p->head) {
-      p->head = p->current = p->tail = item;
-    } else {
-      p->tail->next = item;
-      p->tail = item;
-      p->current = item;
-    }
-
-    p->size += BN_CTX_POOL_SIZE;
-    p->used++;
-    // Return the first bignum from the new pool
-    return item->vals;
-  }
-
-  if (!p->used) {
-    p->current = p->head;
-  } else if ((p->used % BN_CTX_POOL_SIZE) == 0) {
-    p->current = p->current->next;
-  }
-
-  return p->current->vals + ((p->used++) % BN_CTX_POOL_SIZE);
-}
-
-static void BN_POOL_release(BN_POOL *p, unsigned int num) {
-  unsigned int offset = (p->used - 1) % BN_CTX_POOL_SIZE;
-  p->used -= num;
-
-  while (num--) {
-    if (!offset) {
-      offset = BN_CTX_POOL_SIZE - 1;
-      p->current = p->current->prev;
-    } else {
-      offset--;
-    }
-  }
+static size_t BN_STACK_pop(BN_STACK *st) {
+  assert(st->depth > 0);
+  st->depth--;
+  return st->indexes[st->depth];
 }

data/third_party/boringssl/crypto/fipsmodule/bn/div.c

@@ -64,7 +64,7 @@
 #include "internal.h"
 
 
-#if !defined(BN_ULLONG)
+#if !defined(BN_CAN_DIVIDE_ULLONG) && !defined(BN_CAN_USE_INLINE_ASM)
 // bn_div_words divides a double-width |h|,|l| by |d| and returns the result,
 // which must fit in a |BN_ULONG|.
 static BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d) {
@@ -135,7 +135,7 @@ static BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d) {
   ret |= q;
   return ret;
 }
-#endif  // !defined(BN_ULLONG)
+#endif  // !defined(BN_CAN_DIVIDE_ULLONG) && !defined(BN_CAN_USE_INLINE_ASM)
 
 static inline void bn_div_rem_words(BN_ULONG *quotient_out, BN_ULONG *rem_out,
                                     BN_ULONG n0, BN_ULONG n1, BN_ULONG d0) {
@@ -155,20 +155,18 @@ static inline void bn_div_rem_words(BN_ULONG *quotient_out, BN_ULONG *rem_out,
   //
   // These issues aren't specific to x86 and x86_64, so it might be worthwhile
   // to add more assembly language implementations.
-#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86) && \
-    (defined(__GNUC__) || defined(__clang__))
+#if defined(BN_CAN_USE_INLINE_ASM) && defined(OPENSSL_X86)
   __asm__ volatile("divl %4"
                    : "=a"(*quotient_out), "=d"(*rem_out)
                    : "a"(n1), "d"(n0), "rm"(d0)
                    : "cc");
-#elif !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) && \
-    (defined(__GNUC__) || defined(__clang__))
+#elif defined(BN_CAN_USE_INLINE_ASM) && defined(OPENSSL_X86_64)
   __asm__ volatile("divq %4"
                    : "=a"(*quotient_out), "=d"(*rem_out)
                    : "a"(n1), "d"(n0), "rm"(d0)
                    : "cc");
 #else
-#if defined(BN_ULLONG)
+#if defined(BN_CAN_DIVIDE_ULLONG)
   BN_ULLONG n = (((BN_ULLONG)n0) << BN_BITS2) | n1;
   *quotient_out = (BN_ULONG)(n / d0);
 #else
@@ -414,11 +412,37 @@ int BN_nnmod(BIGNUM *r, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx) {
   return (d->neg ? BN_sub : BN_add)(r, r, d);
 }
 
-// bn_mod_sub_words sets |r| to |a| - |b| (mod |m|), using |tmp| as scratch
-// space. Each array is |num| words long. |a| and |b| must be < |m|. Any pair of
-// |r|, |a|, and |b| may alias.
-static void bn_mod_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
-                             const BN_ULONG *m, BN_ULONG *tmp, size_t num) {
+BN_ULONG bn_reduce_once(BN_ULONG *r, const BN_ULONG *a, BN_ULONG carry,
+                        const BN_ULONG *m, size_t num) {
+  assert(r != a);
+  // |r| = |a| - |m|. |bn_sub_words| performs the bulk of the subtraction, and
+  // then we apply the borrow to |carry|.
+  carry -= bn_sub_words(r, a, m, num);
+  // We know 0 <= |a| < 2*|m|, so -|m| <= |r| < |m|.
+  //
+  // If 0 <= |r| < |m|, |r| fits in |num| words and |carry| is zero. We then
+  // wish to select |r| as the answer. Otherwise -m <= r < 0 and we wish to
+  // return |r| + |m|, or |a|. |carry| must then be -1 or all ones. In both
+  // cases, |carry| is a suitable input to |bn_select_words|.
+  //
+  // Although |carry| may be one if it was one on input and |bn_sub_words|
+  // returns zero, this would give |r| > |m|, violating our input assumptions.
+  assert(carry == 0 || carry == (BN_ULONG)-1);
+  bn_select_words(r, carry, a /* r < 0 */, r /* r >= 0 */, num);
+  return carry;
+}
+
+BN_ULONG bn_reduce_once_in_place(BN_ULONG *r, BN_ULONG carry, const BN_ULONG *m,
+                                 BN_ULONG *tmp, size_t num) {
+  // See |bn_reduce_once| for why this logic works.
+  carry -= bn_sub_words(tmp, r, m, num);
+  assert(carry == 0 || carry == (BN_ULONG)-1);
+  bn_select_words(r, carry, r /* tmp < 0 */, tmp /* tmp >= 0 */, num);
+  return carry;
+}
+
+void bn_mod_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
+                      const BN_ULONG *m, BN_ULONG *tmp, size_t num) {
   // r = a - b
   BN_ULONG borrow = bn_sub_words(r, a, b, num);
   // tmp = a - b + m
@@ -426,32 +450,10 @@ static void bn_mod_sub_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
   bn_select_words(r, 0 - borrow, tmp /* r < 0 */, r /* r >= 0 */, num);
 }
 
-// bn_mod_add_words sets |r| to |a| + |b| (mod |m|), using |tmp| as scratch
-// space. Each array is |num| words long. |a| and |b| must be < |m|. Any pair of
-// |r|, |a|, and |b| may alias.
-static void bn_mod_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
-                             const BN_ULONG *m, BN_ULONG *tmp, size_t num) {
-  // tmp = a + b. Note the result fits in |num|+1 words. We store the extra word
-  // in |carry|.
-  BN_ULONG carry = bn_add_words(tmp, a, b, num);
-  // r = a + b - m. We use |bn_sub_words| to perform the bulk of the
-  // subtraction, and then apply the borrow to |carry|.
-  carry -= bn_sub_words(r, tmp, m, num);
-  // |a| and |b| were both fully-reduced, so we know:
-  //
-  //   0 + 0 - m <= r < m + m - m
-  //          -m <= r < m
-  //
-  // If 0 <= |r| < |m|, |r| fits in |num| words and |carry| is zero. We then
-  // wish to select |r| as the answer. Otherwise -m <= r < 0 and we wish to
-  // return |r| + |m|, or |tmp|. |carry| must then be -1 or all ones. In both
-  // cases, |carry| is a suitable input to |bn_select_words|.
-  //
-  // Although |carry| may be one if |bn_add_words| returns one and
-  // |bn_sub_words| returns zero, this would give |r| > |m|, which violates are
-  // input assumptions.
-  assert(carry == 0 || carry == (BN_ULONG)-1);
-  bn_select_words(r, carry, tmp /* r < 0 */, r /* r >= 0 */, num);
+void bn_mod_add_words(BN_ULONG *r, const BN_ULONG *a, const BN_ULONG *b,
+                      const BN_ULONG *m, BN_ULONG *tmp, size_t num) {
+  BN_ULONG carry = bn_add_words(r, a, b, num);
+  bn_reduce_once_in_place(r, carry, m, tmp, num);
 }
 
 int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
@@ -504,27 +506,14 @@ int bn_div_consttime(BIGNUM *quotient, BIGNUM *remainder,
       // extra word in |carry|.
       BN_ULONG carry = bn_add_words(r->d, r->d, r->d, divisor->width);
       r->d[0] |= (numerator->d[i] >> bit) & 1;
-      // tmp = r - divisor. We use |bn_sub_words| to perform the bulk of the
-      // subtraction, and then apply the borrow to |carry|.
-      carry -= bn_sub_words(tmp->d, r->d, divisor->d, divisor->width);
       // |r| was previously fully-reduced, so we know:
-      //
-      //    2*0 - divisor <= tmp <= 2*(divisor-1) + 1 - divisor
-      //         -divisor <= tmp < divisor
-      //
-      // If 0 <= |tmp| < |divisor|, |tmp| fits in |divisor->width| and |carry|
-      // is zero. We then wish to select |tmp|. Otherwise,
-      // -|divisor| <= |tmp| < 0 and we wish to select |tmp| + |divisor|, which
-      // is |r|. |carry| must then be -1 (all ones). In both cases, |carry| is a
-      // suitable input to |bn_select_words|.
-      //
-      // Although |carry| may be one if |bn_add_words| returns one and
-      // |bn_sub_words| returns zero, this would give |r| > |d|, which violates
-      // the loop invariant.
-      bn_select_words(r->d, carry, r->d /* tmp < 0 */, tmp->d /* tmp >= 0 */,
-                      divisor->width);
+      //      2*0 <= r <= 2*(divisor-1) + 1
+      //        0 <= r <= 2*divisor - 1 < 2*divisor.
+      // Thus |r| satisfies the preconditions for |bn_reduce_once_in_place|.
+      BN_ULONG subtracted = bn_reduce_once_in_place(r->d, carry, divisor->d,
+                                                    tmp->d, divisor->width);
       // The corresponding bit of the quotient is set iff we needed to subtract.
-      q->d[i] |= (~carry & 1) << bit;
+      q->d[i] |= (~subtracted & 1) << bit;
     }
   }
 
@@ -600,6 +589,7 @@ int bn_mod_add_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
   if (ok) {
     bn_mod_add_words(r->d, a->d, b->d, m->d, tmp->d, m->width);
     r->width = m->width;
+    r->neg = 0;
   }
   BN_CTX_end(ctx);
   return ok;
@@ -624,6 +614,7 @@ int bn_mod_sub_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
   if (ok) {
     bn_mod_sub_words(r->d, a->d, b->d, m->d, tmp->d, m->width);
     r->width = m->width;
+    r->neg = 0;
   }
   BN_CTX_end(ctx);
   return ok;