grpc 1.27.0 → 1.28.0

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/aes/internal.h

@@ -218,19 +218,17 @@ OPENSSL_INLINE void vpaes_cbc_encrypt(const uint8_t *in, uint8_t *out,
 #endif  // !VPAES
 
 
-void aes_nohw_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
-void aes_nohw_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
 int aes_nohw_set_encrypt_key(const uint8_t *key, unsigned bits,
                              AES_KEY *aeskey);
 int aes_nohw_set_decrypt_key(const uint8_t *key, unsigned bits,
                              AES_KEY *aeskey);
-
-#if !defined(OPENSSL_NO_ASM) && \
-    (defined(OPENSSL_X86_64) || defined(OPENSSL_X86))
-#define AES_NOHW_CBC
+void aes_nohw_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
+void aes_nohw_decrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key);
+void aes_nohw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
+                                   size_t blocks, const AES_KEY *key,
+                                   const uint8_t ivec[16]);
 void aes_nohw_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t len,
                           const AES_KEY *key, uint8_t *ivec, const int enc);
-#endif
 
 
 #if defined(__cplusplus)

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/aes/mode_wrappers.c

@@ -79,12 +79,10 @@ void AES_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t len,
     return;
   }
 
-#if defined(AES_NOHW_CBC)
   if (!vpaes_capable()) {
     aes_nohw_cbc_encrypt(in, out, len, key, ivec, enc);
     return;
   }
-#endif
   if (enc) {
     CRYPTO_cbc128_encrypt(in, out, len, key, ivec, AES_encrypt);
   } else {

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bcm.c

@@ -31,6 +31,7 @@
 #include "../internal.h"
 
 #include "aes/aes.c"
+#include "aes/aes_nohw.c"
 #include "aes/key_wrap.c"
 #include "aes/mode_wrappers.c"
 #include "bn/add.c"
@@ -83,6 +84,7 @@
 #include "modes/cfb.c"
 #include "modes/ctr.c"
 #include "modes/gcm.c"
+#include "modes/gcm_nohw.c"
 #include "modes/ofb.c"
 #include "modes/polyval.c"
 #include "rand/ctrdrbg.c"

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/bn/prime.c

@@ -210,7 +210,7 @@ static const uint16_t kPrimes[] = {
 };
 
 // BN_prime_checks_for_size returns the number of Miller-Rabin iterations
-// necessary for a 'bits'-bit prime.
+// necessary for generating a 'bits'-bit candidate prime.
 //
 //
 // This table is generated using the algorithm of FIPS PUB 186-4
@@ -604,9 +604,8 @@ err:
   return ret;
 }
 
-int BN_primality_test(int *out_is_probably_prime, const BIGNUM *w,
-                      int iterations, BN_CTX *ctx, int do_trial_division,
-                      BN_GENCB *cb) {
+int BN_primality_test(int *out_is_probably_prime, const BIGNUM *w, int checks,
+                      BN_CTX *ctx, int do_trial_division, BN_GENCB *cb) {
   // This function's secrecy and performance requirements come from RSA key
   // generation. We generate RSA keys by selecting two large, secret primes with
   // rejection sampling.
@@ -679,8 +678,8 @@ int BN_primality_test(int *out_is_probably_prime, const BIGNUM *w,
     }
   }
 
-  if (iterations == BN_prime_checks) {
-    iterations = BN_prime_checks_for_size(BN_num_bits(w));
+  if (checks == BN_prime_checks_for_generation) {
+    checks = BN_prime_checks_for_size(BN_num_bits(w));
   }
 
   BN_CTX *new_ctx = NULL;
@@ -736,7 +735,7 @@ int BN_primality_test(int *out_is_probably_prime, const BIGNUM *w,
   // Using |constant_time_lt_w| seems to prevent the compiler from optimizing
   // this into two jumps.
   for (int i = 1; (i <= BN_PRIME_CHECKS_BLINDED) |
-                  constant_time_lt_w(uniform_iterations, iterations);
+                  constant_time_lt_w(uniform_iterations, checks);
        i++) {
     // Step 4.1-4.2
     int is_uniform;
@@ -765,7 +764,7 @@ int BN_primality_test(int *out_is_probably_prime, const BIGNUM *w,
     }
   }
 
-  assert(uniform_iterations >= (crypto_word_t)iterations);
+  assert(uniform_iterations >= (crypto_word_t)checks);
   *out_is_probably_prime = 1;
   ret = 1;
 
@@ -792,7 +791,7 @@ int BN_is_prime_fasttest_ex(const BIGNUM *a, int checks, BN_CTX *ctx,
 }
 
 int BN_enhanced_miller_rabin_primality_test(
-    enum bn_primality_result_t *out_result, const BIGNUM *w, int iterations,
+    enum bn_primality_result_t *out_result, const BIGNUM *w, int checks,
     BN_CTX *ctx, BN_GENCB *cb) {
   // Enhanced Miller-Rabin is only valid on odd integers greater than 3.
   if (!BN_is_odd(w) || BN_cmp_word(w, 3) <= 0) {
@@ -800,8 +799,8 @@ int BN_enhanced_miller_rabin_primality_test(
     return 0;
   }
 
-  if (iterations == BN_prime_checks) {
-    iterations = BN_prime_checks_for_size(BN_num_bits(w));
+  if (checks == BN_prime_checks_for_generation) {
+    checks = BN_prime_checks_for_size(BN_num_bits(w));
   }
 
   int ret = 0;
@@ -848,7 +847,7 @@ int BN_enhanced_miller_rabin_primality_test(
 
   // The following loop performs in inner iteration of the Enhanced Miller-Rabin
   // Primality test (Step 4).
-  for (int i = 1; i <= iterations; i++) {
+  for (int i = 1; i <= checks; i++) {
     // Step 4.1-4.2
     if (!BN_rand_range_ex(b, 2, w1)) {
       goto err;

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/cipher/e_aes.c

@@ -173,11 +173,9 @@ static int aes_init_key(EVP_CIPHER_CTX *ctx, const uint8_t *key,
       ret = aes_nohw_set_decrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
       dat->block = aes_nohw_decrypt;
       dat->stream.cbc = NULL;
-#if defined(AES_NOHW_CBC)
       if (mode == EVP_CIPH_CBC_MODE) {
         dat->stream.cbc = aes_nohw_cbc_encrypt;
       }
-#endif
     }
   } else if (hwaes_capable()) {
     ret = aes_hw_set_encrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
@@ -209,11 +207,9 @@ static int aes_init_key(EVP_CIPHER_CTX *ctx, const uint8_t *key,
     ret = aes_nohw_set_encrypt_key(key, ctx->key_len * 8, &dat->ks.ks);
     dat->block = aes_nohw_encrypt;
     dat->stream.cbc = NULL;
-#if defined(AES_NOHW_CBC)
     if (mode == EVP_CIPH_CBC_MODE) {
       dat->stream.cbc = aes_nohw_cbc_encrypt;
     }
-#endif
   }
 
   if (ret < 0) {
@@ -318,7 +314,7 @@ ctr128_f aes_ctr_set_key(AES_KEY *aes_key, GCM128_KEY *gcm_key,
   if (out_block) {
     *out_block = aes_nohw_encrypt;
   }
-  return NULL;
+  return aes_nohw_ctr32_encrypt_blocks;
 }
 
 #if defined(OPENSSL_32_BIT)
@@ -1296,6 +1292,8 @@ int EVP_has_aes_hardware(void) {
   return hwaes_capable() && crypto_gcm_clmul_enabled();
 #elif defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)
   return hwaes_capable() && CRYPTO_is_ARMv8_PMULL_capable();
+#elif defined(OPENSSL_PPC64LE)
+  return CRYPTO_is_PPC64LE_vcrypto_capable();
 #else
   return 0;
 #endif

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/ec/ec_key.c

@@ -394,7 +394,7 @@ err:
   return ok;
 }
 
-size_t EC_KEY_key2buf(EC_KEY *key, point_conversion_form_t form,
+size_t EC_KEY_key2buf(const EC_KEY *key, point_conversion_form_t form,
                       unsigned char **out_buf, BN_CTX *ctx) {
   if (key == NULL || key->pub_key == NULL || key->group == NULL) {
     return 0;

data/third_party/{boringssl → boringssl-with-bazel/src}/crypto/fipsmodule/modes/gcm.c

@@ -58,38 +58,45 @@
 #include "../../internal.h"
 
 
-#define PACK(s) ((size_t)(s) << (sizeof(size_t) * 8 - 16))
-#define REDUCE1BIT(V)                                                 \
-  do {                                                                \
-    if (sizeof(size_t) == 8) {                                        \
-      uint64_t T = UINT64_C(0xe100000000000000) & (0 - ((V).lo & 1)); \
-      (V).lo = ((V).hi << 63) | ((V).lo >> 1);                        \
-      (V).hi = ((V).hi >> 1) ^ T;                                     \
-    } else {                                                          \
-      uint32_t T = 0xe1000000U & (0 - (uint32_t)((V).lo & 1));        \
-      (V).lo = ((V).hi << 63) | ((V).lo >> 1);                        \
-      (V).hi = ((V).hi >> 1) ^ ((uint64_t)T << 32);                   \
-    }                                                                 \
-  } while (0)
-
 // kSizeTWithoutLower4Bits is a mask that can be used to zero the lower four
 // bits of a |size_t|.
 static const size_t kSizeTWithoutLower4Bits = (size_t) -16;
 
-void gcm_init_4bit(u128 Htable[16], const uint64_t H[2]) {
-  u128 V;
 
+#define GCM_MUL(ctx, Xi) gcm_gmult_nohw((ctx)->Xi.u, (ctx)->gcm_key.Htable)
+#define GHASH(ctx, in, len) \
+  gcm_ghash_nohw((ctx)->Xi.u, (ctx)->gcm_key.Htable, in, len)
+// GHASH_CHUNK is "stride parameter" missioned to mitigate cache
+// trashing effect. In other words idea is to hash data while it's
+// still in L1 cache after encryption pass...
+#define GHASH_CHUNK (3 * 1024)
+
+#if defined(GHASH_ASM_X86_64) || defined(GHASH_ASM_X86)
+static inline void gcm_reduce_1bit(u128 *V) {
+  if (sizeof(size_t) == 8) {
+    uint64_t T = UINT64_C(0xe100000000000000) & (0 - (V->hi & 1));
+    V->hi = (V->lo << 63) | (V->hi >> 1);
+    V->lo = (V->lo >> 1) ^ T;
+  } else {
+    uint32_t T = 0xe1000000U & (0 - (uint32_t)(V->hi & 1));
+    V->hi = (V->lo << 63) | (V->hi >> 1);
+    V->lo = (V->lo >> 1) ^ ((uint64_t)T << 32);
+  }
+}
+
+void gcm_init_ssse3(u128 Htable[16], const uint64_t H[2]) {
   Htable[0].hi = 0;
   Htable[0].lo = 0;
-  V.hi = H[0];
-  V.lo = H[1];
+  u128 V;
+  V.hi = H[1];
+  V.lo = H[0];
 
   Htable[8] = V;
-  REDUCE1BIT(V);
+  gcm_reduce_1bit(&V);
   Htable[4] = V;
-  REDUCE1BIT(V);
+  gcm_reduce_1bit(&V);
   Htable[2] = V;
-  REDUCE1BIT(V);
+  gcm_reduce_1bit(&V);
   Htable[1] = V;
   Htable[3].hi = V.hi ^ Htable[2].hi, Htable[3].lo = V.lo ^ Htable[2].lo;
   V = Htable[4];
@@ -105,156 +112,6 @@ void gcm_init_4bit(u128 Htable[16], const uint64_t H[2]) {
   Htable[14].hi = V.hi ^ Htable[6].hi, Htable[14].lo = V.lo ^ Htable[6].lo;
   Htable[15].hi = V.hi ^ Htable[7].hi, Htable[15].lo = V.lo ^ Htable[7].lo;
 
-#if defined(GHASH_ASM) && defined(OPENSSL_ARM)
-  for (int j = 0; j < 16; ++j) {
-    V = Htable[j];
-    Htable[j].hi = V.lo;
-    Htable[j].lo = V.hi;
-  }
-#endif
-}
-
-#if !defined(GHASH_ASM) || defined(OPENSSL_AARCH64) || defined(OPENSSL_PPC64LE)
-static const size_t rem_4bit[16] = {
-    PACK(0x0000), PACK(0x1C20), PACK(0x3840), PACK(0x2460),
-    PACK(0x7080), PACK(0x6CA0), PACK(0x48C0), PACK(0x54E0),
-    PACK(0xE100), PACK(0xFD20), PACK(0xD940), PACK(0xC560),
-    PACK(0x9180), PACK(0x8DA0), PACK(0xA9C0), PACK(0xB5E0)};
-
-void gcm_gmult_4bit(uint64_t Xi[2], const u128 Htable[16]) {
-  u128 Z;
-  int cnt = 15;
-  size_t rem, nlo, nhi;
-
-  nlo = ((const uint8_t *)Xi)[15];
-  nhi = nlo >> 4;
-  nlo &= 0xf;
-
-  Z.hi = Htable[nlo].hi;
-  Z.lo = Htable[nlo].lo;
-
-  while (1) {
-    rem = (size_t)Z.lo & 0xf;
-    Z.lo = (Z.hi << 60) | (Z.lo >> 4);
-    Z.hi = (Z.hi >> 4);
-    if (sizeof(size_t) == 8) {
-      Z.hi ^= rem_4bit[rem];
-    } else {
-      Z.hi ^= (uint64_t)rem_4bit[rem] << 32;
-    }
-
-    Z.hi ^= Htable[nhi].hi;
-    Z.lo ^= Htable[nhi].lo;
-
-    if (--cnt < 0) {
-      break;
-    }
-
-    nlo = ((const uint8_t *)Xi)[cnt];
-    nhi = nlo >> 4;
-    nlo &= 0xf;
-
-    rem = (size_t)Z.lo & 0xf;
-    Z.lo = (Z.hi << 60) | (Z.lo >> 4);
-    Z.hi = (Z.hi >> 4);
-    if (sizeof(size_t) == 8) {
-      Z.hi ^= rem_4bit[rem];
-    } else {
-      Z.hi ^= (uint64_t)rem_4bit[rem] << 32;
-    }
-
-    Z.hi ^= Htable[nlo].hi;
-    Z.lo ^= Htable[nlo].lo;
-  }
-
-  Xi[0] = CRYPTO_bswap8(Z.hi);
-  Xi[1] = CRYPTO_bswap8(Z.lo);
-}
-
-// Streamed gcm_mult_4bit, see CRYPTO_gcm128_[en|de]crypt for
-// details... Compiler-generated code doesn't seem to give any
-// performance improvement, at least not on x86[_64]. It's here
-// mostly as reference and a placeholder for possible future
-// non-trivial optimization[s]...
-void gcm_ghash_4bit(uint64_t Xi[2], const u128 Htable[16], const uint8_t *inp,
-                    size_t len) {
-  u128 Z;
-  int cnt;
-  size_t rem, nlo, nhi;
-
-  do {
-    cnt = 15;
-    nlo = ((const uint8_t *)Xi)[15];
-    nlo ^= inp[15];
-    nhi = nlo >> 4;
-    nlo &= 0xf;
-
-    Z.hi = Htable[nlo].hi;
-    Z.lo = Htable[nlo].lo;
-
-    while (1) {
-      rem = (size_t)Z.lo & 0xf;
-      Z.lo = (Z.hi << 60) | (Z.lo >> 4);
-      Z.hi = (Z.hi >> 4);
-      if (sizeof(size_t) == 8) {
-        Z.hi ^= rem_4bit[rem];
-      } else {
-        Z.hi ^= (uint64_t)rem_4bit[rem] << 32;
-      }
-
-      Z.hi ^= Htable[nhi].hi;
-      Z.lo ^= Htable[nhi].lo;
-
-      if (--cnt < 0) {
-        break;
-      }
-
-      nlo = ((const uint8_t *)Xi)[cnt];
-      nlo ^= inp[cnt];
-      nhi = nlo >> 4;
-      nlo &= 0xf;
-
-      rem = (size_t)Z.lo & 0xf;
-      Z.lo = (Z.hi << 60) | (Z.lo >> 4);
-      Z.hi = (Z.hi >> 4);
-      if (sizeof(size_t) == 8) {
-        Z.hi ^= rem_4bit[rem];
-      } else {
-        Z.hi ^= (uint64_t)rem_4bit[rem] << 32;
-      }
-
-      Z.hi ^= Htable[nlo].hi;
-      Z.lo ^= Htable[nlo].lo;
-    }
-
-    Xi[0] = CRYPTO_bswap8(Z.hi);
-    Xi[1] = CRYPTO_bswap8(Z.lo);
-  } while (inp += 16, len -= 16);
-}
-#endif   // !GHASH_ASM || AARCH64 || PPC64LE
-
-#define GCM_MUL(ctx, Xi) gcm_gmult_4bit((ctx)->Xi.u, (ctx)->gcm_key.Htable)
-#define GHASH(ctx, in, len) \
-  gcm_ghash_4bit((ctx)->Xi.u, (ctx)->gcm_key.Htable, in, len)
-// GHASH_CHUNK is "stride parameter" missioned to mitigate cache
-// trashing effect. In other words idea is to hash data while it's
-// still in L1 cache after encryption pass...
-#define GHASH_CHUNK (3 * 1024)
-
-#if defined(GHASH_ASM_X86_64) || defined(GHASH_ASM_X86)
-void gcm_init_ssse3(u128 Htable[16], const uint64_t Xi[2]) {
-  // Run the existing 4-bit version.
-  gcm_init_4bit(Htable, Xi);
-
-  // First, swap hi and lo. The "4bit" version places hi first. It treats the
-  // two fields separately, so the order does not matter, but ghash-ssse3 reads
-  // the entire state into one 128-bit register.
-  for (int i = 0; i < 16; i++) {
-    uint64_t tmp = Htable[i].hi;
-    Htable[i].hi = Htable[i].lo;
-    Htable[i].lo = tmp;
-  }
-
   // Treat |Htable| as a 16x16 byte table and transpose it. Thus, Htable[i]
   // contains the i'th byte of j*H for all j.
   uint8_t *Hbytes = (uint8_t *)Htable;
@@ -268,13 +125,13 @@ void gcm_init_ssse3(u128 Htable[16], const uint64_t Xi[2]) {
 }
 #endif  // GHASH_ASM_X86_64 || GHASH_ASM_X86
 
-#ifdef GCM_FUNCREF_4BIT
+#ifdef GCM_FUNCREF
 #undef GCM_MUL
 #define GCM_MUL(ctx, Xi) (*gcm_gmult_p)((ctx)->Xi.u, (ctx)->gcm_key.Htable)
 #undef GHASH
 #define GHASH(ctx, in, len) \
   (*gcm_ghash_p)((ctx)->Xi.u, (ctx)->gcm_key.Htable, in, len)
-#endif  // GCM_FUNCREF_4BIT
+#endif  // GCM_FUNCREF
 
 void CRYPTO_ghash_init(gmult_func *out_mult, ghash_func *out_hash,
                        u128 *out_key, u128 out_table[16], int *out_is_avx,
@@ -350,14 +207,9 @@ void CRYPTO_ghash_init(gmult_func *out_mult, ghash_func *out_hash,
   }
 #endif
 
-  gcm_init_4bit(out_table, H.u);
-#if defined(GHASH_ASM_X86)
-  *out_mult = gcm_gmult_4bit_mmx;
-  *out_hash = gcm_ghash_4bit_mmx;
-#else
-  *out_mult = gcm_gmult_4bit;
-  *out_hash = gcm_ghash_4bit;
-#endif
+  gcm_init_nohw(out_table, H.u);
+  *out_mult = gcm_gmult_nohw;
+  *out_hash = gcm_ghash_nohw;
 }
 
 void CRYPTO_gcm128_init_key(GCM128_KEY *gcm_key, const AES_KEY *aes_key,
@@ -378,7 +230,7 @@ void CRYPTO_gcm128_init_key(GCM128_KEY *gcm_key, const AES_KEY *aes_key,
 
 void CRYPTO_gcm128_setiv(GCM128_CONTEXT *ctx, const AES_KEY *key,
                          const uint8_t *iv, size_t len) {
-#ifdef GCM_FUNCREF_4BIT
+#ifdef GCM_FUNCREF
   void (*gcm_gmult_p)(uint64_t Xi[2], const u128 Htable[16]) =
       ctx->gcm_key.gmult;
 #endif
@@ -427,13 +279,11 @@ void CRYPTO_gcm128_setiv(GCM128_CONTEXT *ctx, const AES_KEY *key,
 }
 
 int CRYPTO_gcm128_aad(GCM128_CONTEXT *ctx, const uint8_t *aad, size_t len) {
-#ifdef GCM_FUNCREF_4BIT
+#ifdef GCM_FUNCREF
   void (*gcm_gmult_p)(uint64_t Xi[2], const u128 Htable[16]) =
       ctx->gcm_key.gmult;
-#ifdef GHASH
   void (*gcm_ghash_p)(uint64_t Xi[2], const u128 Htable[16], const uint8_t *inp,
                       size_t len) = ctx->gcm_key.ghash;
-#endif
 #endif
 
   if (ctx->len.u[1]) {
@@ -484,7 +334,7 @@ int CRYPTO_gcm128_aad(GCM128_CONTEXT *ctx, const uint8_t *aad, size_t len) {
 int CRYPTO_gcm128_encrypt(GCM128_CONTEXT *ctx, const AES_KEY *key,
                           const uint8_t *in, uint8_t *out, size_t len) {
   block128_f block = ctx->gcm_key.block;
-#ifdef GCM_FUNCREF_4BIT
+#ifdef GCM_FUNCREF
   void (*gcm_gmult_p)(uint64_t Xi[2], const u128 Htable[16]) =
       ctx->gcm_key.gmult;
   void (*gcm_ghash_p)(uint64_t Xi[2], const u128 Htable[16], const uint8_t *inp,
@@ -572,7 +422,7 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx, const AES_KEY *key,
                           const unsigned char *in, unsigned char *out,
                           size_t len) {
   block128_f block = ctx->gcm_key.block;
-#ifdef GCM_FUNCREF_4BIT
+#ifdef GCM_FUNCREF
   void (*gcm_gmult_p)(uint64_t Xi[2], const u128 Htable[16]) =
       ctx->gcm_key.gmult;
   void (*gcm_ghash_p)(uint64_t Xi[2], const u128 Htable[16], const uint8_t *inp,
@@ -663,7 +513,7 @@ int CRYPTO_gcm128_decrypt(GCM128_CONTEXT *ctx, const AES_KEY *key,
 int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx, const AES_KEY *key,
                                 const uint8_t *in, uint8_t *out, size_t len,
                                 ctr128_f stream) {
-#ifdef GCM_FUNCREF_4BIT
+#ifdef GCM_FUNCREF
   void (*gcm_gmult_p)(uint64_t Xi[2], const u128 Htable[16]) =
       ctx->gcm_key.gmult;
   void (*gcm_ghash_p)(uint64_t Xi[2], const u128 Htable[16], const uint8_t *inp,
@@ -699,7 +549,8 @@ int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx, const AES_KEY *key,
   }
 
 #if defined(AESNI_GCM)
-  if (ctx->gcm_key.use_aesni_gcm_crypt) {
+  // Check |len| to work around a C language bug. See https://crbug.com/1019588.
+  if (ctx->gcm_key.use_aesni_gcm_crypt && len > 0) {
     // |aesni_gcm_encrypt| may not process all the input given to it. It may
     // not process *any* of its input if it is deemed too small.
     size_t bulk = aesni_gcm_encrypt(in, out, len, key, ctx->Yi.c, ctx->Xi.u);
@@ -748,7 +599,7 @@ int CRYPTO_gcm128_encrypt_ctr32(GCM128_CONTEXT *ctx, const AES_KEY *key,
 int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx, const AES_KEY *key,
                                 const uint8_t *in, uint8_t *out, size_t len,
                                 ctr128_f stream) {
-#ifdef GCM_FUNCREF_4BIT
+#ifdef GCM_FUNCREF
   void (*gcm_gmult_p)(uint64_t Xi[2], const u128 Htable[16]) =
       ctx->gcm_key.gmult;
   void (*gcm_ghash_p)(uint64_t Xi[2], const u128 Htable[16], const uint8_t *inp,
@@ -786,7 +637,8 @@ int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx, const AES_KEY *key,
   }
 
 #if defined(AESNI_GCM)
-  if (ctx->gcm_key.use_aesni_gcm_crypt) {
+  // Check |len| to work around a C language bug. See https://crbug.com/1019588.
+  if (ctx->gcm_key.use_aesni_gcm_crypt && len > 0) {
     // |aesni_gcm_decrypt| may not process all the input given to it. It may
     // not process *any* of its input if it is deemed too small.
     size_t bulk = aesni_gcm_decrypt(in, out, len, key, ctx->Yi.c, ctx->Xi.u);
@@ -835,7 +687,7 @@ int CRYPTO_gcm128_decrypt_ctr32(GCM128_CONTEXT *ctx, const AES_KEY *key,
 }
 
 int CRYPTO_gcm128_finish(GCM128_CONTEXT *ctx, const uint8_t *tag, size_t len) {
-#ifdef GCM_FUNCREF_4BIT
+#ifdef GCM_FUNCREF
   void (*gcm_gmult_p)(uint64_t Xi[2], const u128 Htable[16]) =
       ctx->gcm_key.gmult;
 #endif
@@ -866,7 +718,7 @@ void CRYPTO_gcm128_tag(GCM128_CONTEXT *ctx, unsigned char *tag, size_t len) {
 
 #if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
 int crypto_gcm_clmul_enabled(void) {
-#ifdef GHASH_ASM
+#if defined(GHASH_ASM_X86) || defined(GHASH_ASM_X86_64)
   const uint32_t *ia32cap = OPENSSL_ia32cap_get();
   return (ia32cap[0] & (1 << 24)) &&  // check FXSR bit
          (ia32cap[1] & (1 << 1));     // check PCLMULQDQ bit