grpc 1.40.0 → 1.41.0.pre2

data/third_party/boringssl-with-bazel/src/crypto/lhash/internal.h

@@ -0,0 +1,253 @@
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.] */
+
+#ifndef OPENSSL_HEADER_LHASH_INTERNAL_H
+#define OPENSSL_HEADER_LHASH_INTERNAL_H
+
+#include <openssl/lhash.h>
+
+#if defined(__cplusplus)
+extern "C" {
+#endif
+
+
+// lhash is a traditional, chaining hash table that automatically expands and
+// contracts as needed. One should not use the lh_* functions directly, rather
+// use the type-safe macro wrappers:
+//
+// A hash table of a specific type of object has type |LHASH_OF(type)|. This
+// can be defined (once) with |DEFINE_LHASH_OF(type)| and declared where needed
+// with |DECLARE_LHASH_OF(type)|. For example:
+//
+//   struct foo {
+//     int bar;
+//   };
+//
+//   DEFINE_LHASH_OF(struct foo)
+//
+// Although note that the hash table will contain /pointers/ to |foo|.
+//
+// A macro will be defined for each of the |OPENSSL_lh_*| functions below. For
+// |LHASH_OF(foo)|, the macros would be |lh_foo_new|, |lh_foo_num_items| etc.
+
+
+// lhash_cmp_func is a comparison function that returns a value equal, or not
+// equal, to zero depending on whether |*a| is equal, or not equal to |*b|,
+// respectively. Note the difference between this and |stack_cmp_func| in that
+// this takes pointers to the objects directly.
+//
+// This function's actual type signature is int (*)(const T*, const T*). The
+// low-level |lh_*| functions will be passed a type-specific wrapper to call it
+// correctly.
+typedef int (*lhash_cmp_func)(const void *a, const void *b);
+typedef int (*lhash_cmp_func_helper)(lhash_cmp_func func, const void *a,
+                                     const void *b);
+
+// lhash_hash_func is a function that maps an object to a uniformly distributed
+// uint32_t.
+//
+// This function's actual type signature is uint32_t (*)(const T*). The
+// low-level |lh_*| functions will be passed a type-specific wrapper to call it
+// correctly.
+typedef uint32_t (*lhash_hash_func)(const void *a);
+typedef uint32_t (*lhash_hash_func_helper)(lhash_hash_func func, const void *a);
+
+typedef struct lhash_st _LHASH;
+
+// OPENSSL_lh_new returns a new, empty hash table or NULL on error.
+OPENSSL_EXPORT _LHASH *OPENSSL_lh_new(lhash_hash_func hash,
+                                      lhash_cmp_func comp);
+
+// OPENSSL_lh_free frees the hash table itself but none of the elements. See
+// |OPENSSL_lh_doall|.
+OPENSSL_EXPORT void OPENSSL_lh_free(_LHASH *lh);
+
+// OPENSSL_lh_num_items returns the number of items in |lh|.
+OPENSSL_EXPORT size_t OPENSSL_lh_num_items(const _LHASH *lh);
+
+// OPENSSL_lh_retrieve finds an element equal to |data| in the hash table and
+// returns it. If no such element exists, it returns NULL.
+OPENSSL_EXPORT void *OPENSSL_lh_retrieve(const _LHASH *lh, const void *data,
+                                         lhash_hash_func_helper call_hash_func,
+                                         lhash_cmp_func_helper call_cmp_func);
+
+// OPENSSL_lh_retrieve_key finds an element matching |key|, given the specified
+// hash and comparison function. This differs from |OPENSSL_lh_retrieve| in that
+// the key may be a different type than the values stored in |lh|. |key_hash|
+// and |cmp_key| must be compatible with the functions passed into
+// |OPENSSL_lh_new|.
+OPENSSL_EXPORT void *OPENSSL_lh_retrieve_key(const _LHASH *lh, const void *key,
+                                             uint32_t key_hash,
+                                             int (*cmp_key)(const void *key,
+                                                            const void *value));
+
+// OPENSSL_lh_insert inserts |data| into the hash table. If an existing element
+// is equal to |data| (with respect to the comparison function) then |*old_data|
+// will be set to that value and it will be replaced. Otherwise, or in the
+// event of an error, |*old_data| will be set to NULL. It returns one on
+// success or zero in the case of an allocation error.
+OPENSSL_EXPORT int OPENSSL_lh_insert(_LHASH *lh, void **old_data, void *data,
+                                     lhash_hash_func_helper call_hash_func,
+                                     lhash_cmp_func_helper call_cmp_func);
+
+// OPENSSL_lh_delete removes an element equal to |data| from the hash table and
+// returns it. If no such element is found, it returns NULL.
+OPENSSL_EXPORT void *OPENSSL_lh_delete(_LHASH *lh, const void *data,
+                                       lhash_hash_func_helper call_hash_func,
+                                       lhash_cmp_func_helper call_cmp_func);
+
+// OPENSSL_lh_doall_arg calls |func| on each element of the hash table and also
+// passes |arg| as the second argument.
+// TODO(fork): rename this
+OPENSSL_EXPORT void OPENSSL_lh_doall_arg(_LHASH *lh,
+                                         void (*func)(void *, void *),
+                                         void *arg);
+
+#define DEFINE_LHASH_OF(type)                                                  \
+  DECLARE_LHASH_OF(type)                                                       \
+                                                                               \
+  typedef int (*lhash_##type##_cmp_func)(const type *, const type *);          \
+  typedef uint32_t (*lhash_##type##_hash_func)(const type *);                  \
+                                                                               \
+  OPENSSL_INLINE int lh_##type##_call_cmp_func(lhash_cmp_func func,            \
+                                               const void *a, const void *b) { \
+    return ((lhash_##type##_cmp_func)func)((const type *)a, (const type *)b);  \
+  }                                                                            \
+                                                                               \
+  OPENSSL_INLINE uint32_t lh_##type##_call_hash_func(lhash_hash_func func,     \
+                                                     const void *a) {          \
+    return ((lhash_##type##_hash_func)func)((const type *)a);                  \
+  }                                                                            \
+                                                                               \
+  OPENSSL_INLINE LHASH_OF(type) *lh_##type##_new(                              \
+      lhash_##type##_hash_func hash, lhash_##type##_cmp_func comp) {           \
+    return (LHASH_OF(type) *)OPENSSL_lh_new((lhash_hash_func)hash,             \
+                                            (lhash_cmp_func)comp);             \
+  }                                                                            \
+                                                                               \
+  OPENSSL_INLINE void lh_##type##_free(LHASH_OF(type) *lh) {                   \
+    OPENSSL_lh_free((_LHASH *)lh);                                             \
+  }                                                                            \
+                                                                               \
+  OPENSSL_INLINE size_t lh_##type##_num_items(const LHASH_OF(type) *lh) {      \
+    return OPENSSL_lh_num_items((const _LHASH *)lh);                           \
+  }                                                                            \
+                                                                               \
+  OPENSSL_INLINE type *lh_##type##_retrieve(const LHASH_OF(type) *lh,          \
+                                            const type *data) {                \
+    return (type *)OPENSSL_lh_retrieve((const _LHASH *)lh, data,               \
+                                       lh_##type##_call_hash_func,             \
+                                       lh_##type##_call_cmp_func);             \
+  }                                                                            \
+                                                                               \
+  typedef struct {                                                             \
+    int (*cmp_key)(const void *key, const type *value);                        \
+    const void *key;                                                           \
+  } LHASH_CMP_KEY_##type;                                                      \
+                                                                               \
+  OPENSSL_INLINE int lh_##type##_call_cmp_key(const void *key,                 \
+                                              const void *value) {             \
+    const LHASH_CMP_KEY_##type *cb = (const LHASH_CMP_KEY_##type *)key;        \
+    return cb->cmp_key(cb->key, (const type *)value);                          \
+  }                                                                            \
+                                                                               \
+  OPENSSL_INLINE type *lh_##type##_retrieve_key(                               \
+      const LHASH_OF(type) *lh, const void *key, uint32_t key_hash,            \
+      int (*cmp_key)(const void *key, const type *value)) {                    \
+    LHASH_CMP_KEY_##type cb = {cmp_key, key};                                  \
+    return (type *)OPENSSL_lh_retrieve_key((const _LHASH *)lh, &cb, key_hash,  \
+                                           lh_##type##_call_cmp_key);          \
+  }                                                                            \
+                                                                               \
+  OPENSSL_INLINE int lh_##type##_insert(LHASH_OF(type) *lh, type **old_data,   \
+                                        type *data) {                          \
+    void *old_data_void = NULL;                                                \
+    int ret = OPENSSL_lh_insert((_LHASH *)lh, &old_data_void, data,            \
+                                lh_##type##_call_hash_func,                    \
+                                lh_##type##_call_cmp_func);                    \
+    *old_data = (type *)old_data_void;                                         \
+    return ret;                                                                \
+  }                                                                            \
+                                                                               \
+  OPENSSL_INLINE type *lh_##type##_delete(LHASH_OF(type) *lh,                  \
+                                          const type *data) {                  \
+    return (type *)OPENSSL_lh_delete((_LHASH *)lh, data,                       \
+                                     lh_##type##_call_hash_func,               \
+                                     lh_##type##_call_cmp_func);               \
+  }                                                                            \
+                                                                               \
+  typedef struct {                                                             \
+    void (*doall_arg)(type *, void *);                                         \
+    void *arg;                                                                 \
+  } LHASH_DOALL_##type;                                                        \
+                                                                               \
+  OPENSSL_INLINE void lh_##type##_call_doall_arg(void *value, void *arg) {     \
+    const LHASH_DOALL_##type *cb = (const LHASH_DOALL_##type *)arg;            \
+    cb->doall_arg((type *)value, cb->arg);                                     \
+  }                                                                            \
+                                                                               \
+  OPENSSL_INLINE void lh_##type##_doall_arg(                                   \
+      LHASH_OF(type) *lh, void (*func)(type *, void *), void *arg) {           \
+    LHASH_DOALL_##type cb = {func, arg};                                       \
+    OPENSSL_lh_doall_arg((_LHASH *)lh, lh_##type##_call_doall_arg, &cb);       \
+  }
+
+
+#if defined(__cplusplus)
+}  // extern C
+#endif
+
+#endif  // OPENSSL_HEADER_LHASH_INTERNAL_H

data/third_party/boringssl-with-bazel/src/crypto/lhash/lhash.c

@@ -62,6 +62,7 @@
 
 #include <openssl/mem.h>
 
+#include "internal.h"
 #include "../internal.h"
 
 
@@ -73,6 +74,16 @@ static const size_t kMinNumBuckets = 16;
 static const size_t kMaxAverageChainLength = 2;
 static const size_t kMinAverageChainLength = 1;
 
+// lhash_item_st is an element of a hash chain. It points to the opaque data
+// for this element and to the next item in the chain. The linked-list is NULL
+// terminated.
+typedef struct lhash_item_st {
+  void *data;
+  struct lhash_item_st *next;
+  // hash contains the cached, hash value of |data|.
+  uint32_t hash;
+} LHASH_ITEM;
+
 struct lhash_st {
   // num_items contains the total number of items in the hash table.
   size_t num_items;
@@ -92,7 +103,7 @@ struct lhash_st {
   lhash_hash_func hash;
 };
 
-_LHASH *lh_new(lhash_hash_func hash, lhash_cmp_func comp) {
+_LHASH *OPENSSL_lh_new(lhash_hash_func hash, lhash_cmp_func comp) {
   _LHASH *ret = OPENSSL_malloc(sizeof(_LHASH));
   if (ret == NULL) {
     return NULL;
@@ -112,7 +123,7 @@ _LHASH *lh_new(lhash_hash_func hash, lhash_cmp_func comp) {
   return ret;
 }
 
-void lh_free(_LHASH *lh) {
+void OPENSSL_lh_free(_LHASH *lh) {
   if (lh == NULL) {
     return;
   }
@@ -129,7 +140,7 @@ void lh_free(_LHASH *lh) {
   OPENSSL_free(lh);
 }
 
-size_t lh_num_items(const _LHASH *lh) { return lh->num_items; }
+size_t OPENSSL_lh_num_items(const _LHASH *lh) { return lh->num_items; }
 
 // get_next_ptr_and_hash returns a pointer to the pointer that points to the
 // item equal to |data|. In other words, it searches for an item equal to |data|
@@ -175,16 +186,18 @@ static LHASH_ITEM **get_next_ptr_by_key(const _LHASH *lh, const void *key,
   return ret;
 }
 
-void *lh_retrieve(const _LHASH *lh, const void *data,
-                  lhash_hash_func_helper call_hash_func,
-                  lhash_cmp_func_helper call_cmp_func) {
+void *OPENSSL_lh_retrieve(const _LHASH *lh, const void *data,
+                          lhash_hash_func_helper call_hash_func,
+                          lhash_cmp_func_helper call_cmp_func) {
   LHASH_ITEM **next_ptr =
       get_next_ptr_and_hash(lh, NULL, data, call_hash_func, call_cmp_func);
   return *next_ptr == NULL ? NULL : (*next_ptr)->data;
 }
 
-void *lh_retrieve_key(const _LHASH *lh, const void *key, uint32_t key_hash,
-                      int (*cmp_key)(const void *key, const void *value)) {
+void *OPENSSL_lh_retrieve_key(const _LHASH *lh, const void *key,
+                              uint32_t key_hash,
+                              int (*cmp_key)(const void *key,
+                                             const void *value)) {
   LHASH_ITEM **next_ptr = get_next_ptr_by_key(lh, key, key_hash, cmp_key);
   return *next_ptr == NULL ? NULL : (*next_ptr)->data;
 }
@@ -252,9 +265,9 @@ static void lh_maybe_resize(_LHASH *lh) {
   }
 }
 
-int lh_insert(_LHASH *lh, void **old_data, void *data,
-              lhash_hash_func_helper call_hash_func,
-              lhash_cmp_func_helper call_cmp_func) {
+int OPENSSL_lh_insert(_LHASH *lh, void **old_data, void *data,
+                      lhash_hash_func_helper call_hash_func,
+                      lhash_cmp_func_helper call_cmp_func) {
   uint32_t hash;
   LHASH_ITEM **next_ptr, *item;
 
@@ -287,9 +300,9 @@ int lh_insert(_LHASH *lh, void **old_data, void *data,
   return 1;
 }
 
-void *lh_delete(_LHASH *lh, const void *data,
-                lhash_hash_func_helper call_hash_func,
-                lhash_cmp_func_helper call_cmp_func) {
+void *OPENSSL_lh_delete(_LHASH *lh, const void *data,
+                        lhash_hash_func_helper call_hash_func,
+                        lhash_cmp_func_helper call_cmp_func) {
   LHASH_ITEM **next_ptr, *item, *ret;
 
   next_ptr =
@@ -311,7 +324,7 @@ void *lh_delete(_LHASH *lh, const void *data,
   return ret;
 }
 
-void lh_doall_arg(_LHASH *lh, void (*func)(void *, void *), void *arg) {
+void OPENSSL_lh_doall_arg(_LHASH *lh, void (*func)(void *, void *), void *arg) {
   if (lh == NULL) {
     return;
   }
@@ -338,11 +351,3 @@ void lh_doall_arg(_LHASH *lh, void (*func)(void *, void *), void *arg) {
   // resizing is done here.
   lh_maybe_resize(lh);
 }
-
-uint32_t lh_strhash(const char *c) {
-  if (c == NULL) {
-    return 0;
-  }
-
-  return OPENSSL_hash32(c, strlen(c));
-}

data/third_party/boringssl-with-bazel/src/crypto/mem.c

@@ -247,6 +247,8 @@ uint32_t OPENSSL_hash32(const void *ptr, size_t len) {
   return h;
 }
 
+uint32_t OPENSSL_strhash(const char *s) { return OPENSSL_hash32(s, strlen(s)); }
+
 size_t OPENSSL_strnlen(const char *s, size_t len) {
   for (size_t i = 0; i < len; i++) {
     if (s[i] == 0) {

data/third_party/boringssl-with-bazel/src/crypto/obj/obj.c

@@ -67,8 +67,12 @@
 #include <openssl/mem.h>
 #include <openssl/thread.h>
 
-#include "obj_dat.h"
+#include "../asn1/internal.h"
 #include "../internal.h"
+#include "../lhash/internal.h"
+
+// obj_data.h must be included after the definition of |ASN1_OBJECT|.
+#include "obj_dat.h"
 
 
 DEFINE_LHASH_OF(ASN1_OBJECT)
@@ -484,7 +488,7 @@ static int cmp_data(const ASN1_OBJECT *a, const ASN1_OBJECT *b) {
 }
 
 static uint32_t hash_short_name(const ASN1_OBJECT *obj) {
-  return lh_strhash(obj->sn);
+  return OPENSSL_strhash(obj->sn);
 }
 
 static int cmp_short_name(const ASN1_OBJECT *a, const ASN1_OBJECT *b) {
@@ -492,7 +496,7 @@ static int cmp_short_name(const ASN1_OBJECT *a, const ASN1_OBJECT *b) {
 }
 
 static uint32_t hash_long_name(const ASN1_OBJECT *obj) {
-  return lh_strhash(obj->ln);
+  return OPENSSL_strhash(obj->ln);
 }
 
 static int cmp_long_name(const ASN1_OBJECT *a, const ASN1_OBJECT *b) {

data/third_party/boringssl-with-bazel/src/crypto/poly1305/poly1305.c

@@ -56,7 +56,7 @@ OPENSSL_STATIC_ASSERT(
 
 static inline struct poly1305_state_st *poly1305_aligned_state(
     poly1305_state *state) {
-  return (struct poly1305_state_st *)(((uintptr_t)state + 63) & ~63);
+  return align_pointer(state, 64);
 }
 
 // poly1305_blocks updates |state| given some amount of input data. This

data/third_party/boringssl-with-bazel/src/crypto/pool/pool.c

@@ -22,6 +22,7 @@
 #include <openssl/thread.h>
 
 #include "../internal.h"
+#include "../lhash/internal.h"
 #include "internal.h"
 
 

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/deterministic.c

@@ -49,4 +49,8 @@ void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   CRYPTO_chacha_20(out, out, requested, kZeroKey, nonce, 0);
 }
 
+void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
+  CRYPTO_sysrand(out, requested);
+}
+
 #endif  // BORINGSSL_UNSAFE_DETERMINISTIC_MODE

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/fuchsia.c

@@ -27,4 +27,8 @@ void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   zx_cprng_draw(out, requested);
 }
 
+void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
+  CRYPTO_sysrand(out, requested);
+}
+
 #endif  // OPENSSL_FUCHSIA && !BORINGSSL_UNSAFE_DETERMINISTIC_MODE

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/windows.c

@@ -66,4 +66,8 @@ void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   return;
 }
 
+void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
+  CRYPTO_sysrand(out, requested);
+}
+
 #endif  // OPENSSL_WINDOWS && !BORINGSSL_UNSAFE_DETERMINISTIC_MODE

data/third_party/boringssl-with-bazel/src/crypto/x509/a_strex.c

@@ -64,7 +64,7 @@
 #include <openssl/obj.h>
 
 #include "charmap.h"
-#include "../asn1/asn1_locl.h"
+#include "../asn1/internal.h"
 
 /*
  * ASN1_STRING_print_ex() and X509_NAME_print_ex(). Enhanced string and name
@@ -627,7 +627,7 @@ int ASN1_STRING_print_ex_fp(FILE *fp, const ASN1_STRING *str, unsigned long flag
  * in output string or a negative error code
  */
 
-int ASN1_STRING_to_UTF8(unsigned char **out, ASN1_STRING *in)
+int ASN1_STRING_to_UTF8(unsigned char **out, const ASN1_STRING *in)
 {
     ASN1_STRING stmp, *str = &stmp;
     int mbflag, type, ret;

data/third_party/boringssl-with-bazel/src/crypto/x509/a_verify.c

@@ -69,23 +69,27 @@
 
 #include "internal.h"
 
-int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a,
-                     ASN1_BIT_STRING *signature, void *asn, EVP_PKEY *pkey)
-{
-    EVP_MD_CTX ctx;
-    uint8_t *buf_in = NULL;
-    int ret = 0, inl = 0;
-
+int ASN1_item_verify(const ASN1_ITEM *it, const X509_ALGOR *a,
+                     const ASN1_BIT_STRING *signature, void *asn,
+                     EVP_PKEY *pkey) {
     if (!pkey) {
         OPENSSL_PUT_ERROR(X509, ERR_R_PASSED_NULL_PARAMETER);
         return 0;
     }
 
-    if (signature->type == V_ASN1_BIT_STRING && signature->flags & 0x7) {
-        OPENSSL_PUT_ERROR(X509, X509_R_INVALID_BIT_STRING_BITS_LEFT);
-        return 0;
+    size_t sig_len;
+    if (signature->type == V_ASN1_BIT_STRING) {
+        if (!ASN1_BIT_STRING_num_bytes(signature, &sig_len)) {
+            OPENSSL_PUT_ERROR(X509, X509_R_INVALID_BIT_STRING_BITS_LEFT);
+            return 0;
+        }
+    } else {
+        sig_len = (size_t)ASN1_STRING_length(signature);
     }
 
+    EVP_MD_CTX ctx;
+    uint8_t *buf_in = NULL;
+    int ret = 0, inl = 0;
     EVP_MD_CTX_init(&ctx);
 
     if (!x509_digest_verify_init(&ctx, a, pkey)) {
@@ -99,7 +103,7 @@ int ASN1_item_verify(const ASN1_ITEM *it, X509_ALGOR *a,
         goto err;
     }
 
-    if (!EVP_DigestVerify(&ctx, signature->data, (size_t)signature->length,
+    if (!EVP_DigestVerify(&ctx, ASN1_STRING_get0_data(signature), sig_len,
                           buf_in, inl)) {
         OPENSSL_PUT_ERROR(X509, ERR_R_EVP_LIB);
         goto err;

data/third_party/boringssl-with-bazel/src/crypto/x509/algorithm.c

@@ -110,7 +110,7 @@ int x509_digest_sign_algorithm(EVP_MD_CTX *ctx, X509_ALGOR *algor) {
   return 1;
 }
 
-int x509_digest_verify_init(EVP_MD_CTX *ctx, X509_ALGOR *sigalg,
+int x509_digest_verify_init(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
                             EVP_PKEY *pkey) {
   /* Convert the signature OID into digest and public key OIDs. */
   int sigalg_nid = OBJ_obj2nid(sigalg->algorithm);

data/third_party/boringssl-with-bazel/src/crypto/x509/by_dir.c

@@ -68,6 +68,7 @@
 #if !defined(OPENSSL_TRUSTY)
 
 #include "../internal.h"
+#include "internal.h"
 
 typedef struct lookup_dir_hashes_st {
     unsigned long hash;

data/third_party/boringssl-with-bazel/src/crypto/x509/internal.h

@@ -94,6 +94,12 @@ struct x509_cert_aux_st {
   STACK_OF(X509_ALGOR) *other;    // other unspecified info
 } /* X509_CERT_AUX */;
 
+struct X509_extension_st {
+  ASN1_OBJECT *object;
+  ASN1_BOOLEAN critical;
+  ASN1_OCTET_STRING *value;
+} /* X509_EXTENSION */;
+
 typedef struct {
   ASN1_ENCODING enc;
   ASN1_INTEGER *version;
@@ -112,6 +118,42 @@ struct X509_req_st {
   CRYPTO_refcount_t references;
 } /* X509_REQ */;
 
+typedef struct {
+  ASN1_INTEGER *version;
+  X509_ALGOR *sig_alg;
+  X509_NAME *issuer;
+  ASN1_TIME *lastUpdate;
+  ASN1_TIME *nextUpdate;
+  STACK_OF(X509_REVOKED) *revoked;
+  STACK_OF(X509_EXTENSION) /* [0] */ *extensions;
+  ASN1_ENCODING enc;
+} X509_CRL_INFO;
+
+DECLARE_ASN1_FUNCTIONS(X509_CRL_INFO)
+
+struct X509_crl_st {
+  // actual signature
+  X509_CRL_INFO *crl;
+  X509_ALGOR *sig_alg;
+  ASN1_BIT_STRING *signature;
+  CRYPTO_refcount_t references;
+  int flags;
+  // Copies of various extensions
+  AUTHORITY_KEYID *akid;
+  ISSUING_DIST_POINT *idp;
+  // Convenient breakdown of IDP
+  int idp_flags;
+  int idp_reasons;
+  // CRL and base CRL numbers for delta processing
+  ASN1_INTEGER *crl_number;
+  ASN1_INTEGER *base_crl_number;
+  unsigned char sha1_hash[SHA_DIGEST_LENGTH];
+  STACK_OF(GENERAL_NAMES) *issuers;
+  const X509_CRL_METHOD *meth;
+  void *meth_data;
+} /* X509_CRL */;
+
+
 struct X509_VERIFY_PARAM_st {
   char *name;
   time_t check_time;                // Time to use
@@ -139,7 +181,8 @@ struct X509_VERIFY_PARAM_st {
  * signature algorithm parameters in |sigalg| (which must have type
  * |NID_rsassaPss|) and key |pkey|. It returns one on success and zero on
  * error. */
-int x509_rsa_pss_to_ctx(EVP_MD_CTX *ctx, X509_ALGOR *sigalg, EVP_PKEY *pkey);
+int x509_rsa_pss_to_ctx(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
+                        EVP_PKEY *pkey);
 
 /* x509_rsa_pss_to_ctx sets |algor| to the signature algorithm parameters for
  * |ctx|, which must have been configured for an RSA-PSS signing operation. It
@@ -164,7 +207,7 @@ int x509_digest_sign_algorithm(EVP_MD_CTX *ctx, X509_ALGOR *algor);
  * with public key |pkey| and parameters from |algor|. The |ctx| argument must
  * have been initialised with |EVP_MD_CTX_init|. It returns one on success, or
  * zero on error. */
-int x509_digest_verify_init(EVP_MD_CTX *ctx, X509_ALGOR *sigalg,
+int x509_digest_verify_init(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
                             EVP_PKEY *pkey);
 
 

data/third_party/boringssl-with-bazel/src/crypto/x509/rsa_pss.c

@@ -167,7 +167,8 @@ static const EVP_MD *rsa_algor_to_md(X509_ALGOR *alg) {
 }
 
 /* convert MGF1 algorithm ID to EVP_MD, default SHA1 */
-static const EVP_MD *rsa_mgf1_to_md(X509_ALGOR *alg, X509_ALGOR *maskHash) {
+static const EVP_MD *rsa_mgf1_to_md(const X509_ALGOR *alg,
+                                    X509_ALGOR *maskHash) {
   const EVP_MD *md;
   if (!alg) {
     return EVP_sha1();
@@ -246,7 +247,8 @@ err:
   return ret;
 }
 
-int x509_rsa_pss_to_ctx(EVP_MD_CTX *ctx, X509_ALGOR *sigalg, EVP_PKEY *pkey) {
+int x509_rsa_pss_to_ctx(EVP_MD_CTX *ctx, const X509_ALGOR *sigalg,
+                        EVP_PKEY *pkey) {
   assert(OBJ_obj2nid(sigalg->algorithm) == NID_rsassaPss);
 
   /* Decode PSS parameters */