grpc 1.53.0 → 1.58.0

data/third_party/boringssl-with-bazel/src/crypto/ex_data.c

@@ -109,12 +109,13 @@
 #include <openssl/ex_data.h>
 
 #include <assert.h>
+#include <limits.h>
+#include <stdlib.h>
 #include <string.h>
 
 #include <openssl/crypto.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
-#include <openssl/stack.h>
 #include <openssl/thread.h>
 
 #include "internal.h"
@@ -126,67 +127,72 @@ struct crypto_ex_data_func_st {
   long argl;   // Arbitary long
   void *argp;  // Arbitary void pointer
   CRYPTO_EX_free *free_func;
+  // next points to the next |CRYPTO_EX_DATA_FUNCS| or NULL if this is the last
+  // one. It may only be read if synchronized with a read from |num_funcs|.
+  CRYPTO_EX_DATA_FUNCS *next;
 };
 
 int CRYPTO_get_ex_new_index(CRYPTO_EX_DATA_CLASS *ex_data_class, int *out_index,
                             long argl, void *argp, CRYPTO_EX_free *free_func) {
-  CRYPTO_EX_DATA_FUNCS *funcs;
-  int ret = 0;
-
-  funcs = OPENSSL_malloc(sizeof(CRYPTO_EX_DATA_FUNCS));
+  CRYPTO_EX_DATA_FUNCS *funcs = OPENSSL_malloc(sizeof(CRYPTO_EX_DATA_FUNCS));
   if (funcs == NULL) {
-    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_MALLOC_FAILURE);
     return 0;
   }
 
   funcs->argl = argl;
   funcs->argp = argp;
   funcs->free_func = free_func;
+  funcs->next = NULL;
 
-  CRYPTO_STATIC_MUTEX_lock_write(&ex_data_class->lock);
+  CRYPTO_MUTEX_lock_write(&ex_data_class->lock);
 
-  if (ex_data_class->meth == NULL) {
-    ex_data_class->meth = sk_CRYPTO_EX_DATA_FUNCS_new_null();
+  uint32_t num_funcs = CRYPTO_atomic_load_u32(&ex_data_class->num_funcs);
+  // The index must fit in |int|.
+  if (num_funcs > (size_t)(INT_MAX - ex_data_class->num_reserved)) {
+    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW);
+    CRYPTO_MUTEX_unlock_write(&ex_data_class->lock);
+    return 0;
   }
 
-  if (ex_data_class->meth == NULL ||
-      !sk_CRYPTO_EX_DATA_FUNCS_push(ex_data_class->meth, funcs)) {
-    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_MALLOC_FAILURE);
-    OPENSSL_free(funcs);
-    goto err;
+  // Append |funcs| to the linked list.
+  if (ex_data_class->last == NULL) {
+    assert(num_funcs == 0);
+    ex_data_class->funcs = funcs;
+    ex_data_class->last = funcs;
+  } else {
+    ex_data_class->last->next = funcs;
+    ex_data_class->last = funcs;
   }
 
-  *out_index = sk_CRYPTO_EX_DATA_FUNCS_num(ex_data_class->meth) - 1 +
-               ex_data_class->num_reserved;
-  ret = 1;
-
-err:
-  CRYPTO_STATIC_MUTEX_unlock_write(&ex_data_class->lock);
-  return ret;
+  CRYPTO_atomic_store_u32(&ex_data_class->num_funcs, num_funcs + 1);
+  CRYPTO_MUTEX_unlock_write(&ex_data_class->lock);
+  *out_index = (int)num_funcs + ex_data_class->num_reserved;
+  return 1;
 }
 
 int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int index, void *val) {
-  int n, i;
+  if (index < 0) {
+    // A caller that can accidentally pass in an invalid index into this
+    // function will hit an memory error if |index| happened to be valid, and
+    // expected |val| to be of a different type.
+    abort();
+  }
 
   if (ad->sk == NULL) {
     ad->sk = sk_void_new_null();
     if (ad->sk == NULL) {
-      OPENSSL_PUT_ERROR(CRYPTO, ERR_R_MALLOC_FAILURE);
       return 0;
     }
   }
 
-  n = sk_void_num(ad->sk);
-
   // Add NULL values until the stack is long enough.
-  for (i = n; i <= index; i++) {
+  for (size_t i = sk_void_num(ad->sk); i <= (size_t)index; i++) {
     if (!sk_void_push(ad->sk, NULL)) {
-      OPENSSL_PUT_ERROR(CRYPTO, ERR_R_MALLOC_FAILURE);
       return 0;
     }
   }
 
-  sk_void_set(ad->sk, index, val);
+  sk_void_set(ad->sk, (size_t)index, val);
   return 1;
 }
 
@@ -197,34 +203,6 @@ void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx) {
   return sk_void_value(ad->sk, idx);
 }
 
-// get_func_pointers takes a copy of the CRYPTO_EX_DATA_FUNCS pointers, if any,
-// for the given class. If there are some pointers, it sets |*out| to point to
-// a fresh stack of them. Otherwise it sets |*out| to NULL. It returns one on
-// success or zero on error.
-static int get_func_pointers(STACK_OF(CRYPTO_EX_DATA_FUNCS) **out,
-                             CRYPTO_EX_DATA_CLASS *ex_data_class) {
-  size_t n;
-
-  *out = NULL;
-
-  // CRYPTO_EX_DATA_FUNCS structures are static once set, so we can take a
-  // shallow copy of the list under lock and then use the structures without
-  // the lock held.
-  CRYPTO_STATIC_MUTEX_lock_read(&ex_data_class->lock);
-  n = sk_CRYPTO_EX_DATA_FUNCS_num(ex_data_class->meth);
-  if (n > 0) {
-    *out = sk_CRYPTO_EX_DATA_FUNCS_dup(ex_data_class->meth);
-  }
-  CRYPTO_STATIC_MUTEX_unlock_read(&ex_data_class->lock);
-
-  if (n > 0 && *out == NULL) {
-    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_MALLOC_FAILURE);
-    return 0;
-  }
-
-  return 1;
-}
-
 void CRYPTO_new_ex_data(CRYPTO_EX_DATA *ad) {
   ad->sk = NULL;
 }
@@ -236,24 +214,22 @@ void CRYPTO_free_ex_data(CRYPTO_EX_DATA_CLASS *ex_data_class, void *obj,
     return;
   }
 
-  STACK_OF(CRYPTO_EX_DATA_FUNCS) *func_pointers;
-  if (!get_func_pointers(&func_pointers, ex_data_class)) {
-    // TODO(davidben): This leaks memory on malloc error.
-    return;
-  }
-
-  for (size_t i = 0; i < sk_CRYPTO_EX_DATA_FUNCS_num(func_pointers); i++) {
-    CRYPTO_EX_DATA_FUNCS *func_pointer =
-        sk_CRYPTO_EX_DATA_FUNCS_value(func_pointers, i);
-    if (func_pointer->free_func) {
-      void *ptr = CRYPTO_get_ex_data(ad, i + ex_data_class->num_reserved);
-      func_pointer->free_func(obj, ptr, ad, i + ex_data_class->num_reserved,
-                              func_pointer->argl, func_pointer->argp);
+  uint32_t num_funcs = CRYPTO_atomic_load_u32(&ex_data_class->num_funcs);
+  // |CRYPTO_get_ex_new_index| will not allocate indices beyond |INT_MAX|.
+  assert(num_funcs <= (size_t)(INT_MAX - ex_data_class->num_reserved));
+
+  // Defer dereferencing |ex_data_class->funcs| and |funcs->next|. It must come
+  // after the |num_funcs| comparison to be correctly synchronized.
+  CRYPTO_EX_DATA_FUNCS *const *funcs = &ex_data_class->funcs;
+  for (uint32_t i = 0; i < num_funcs; i++) {
+    if ((*funcs)->free_func != NULL) {
+      int index = (int)i + ex_data_class->num_reserved;
+      void *ptr = CRYPTO_get_ex_data(ad, index);
+      (*funcs)->free_func(obj, ptr, ad, index, (*funcs)->argl, (*funcs)->argp);
     }
+    funcs = &(*funcs)->next;
   }
 
-  sk_CRYPTO_EX_DATA_FUNCS_free(func_pointers);
-
   sk_void_free(ad->sk);
   ad->sk = NULL;
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/aes.c

@@ -50,8 +50,6 @@
 
 #include <assert.h>
 
-#include <openssl/cpu.h>
-
 #include "internal.h"
 #include "../modes/internal.h"
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/aes_nohw.c

@@ -18,6 +18,7 @@
 #include <string.h>
 
 #include "../../internal.h"
+#include "internal.h"
 
 #if defined(OPENSSL_SSE2)
 #include <emmintrin.h>
@@ -151,10 +152,10 @@ static inline aes_word_t aes_nohw_shift_right(aes_word_t a, aes_word_t i) {
 }
 #endif  // OPENSSL_SSE2
 
-OPENSSL_STATIC_ASSERT(AES_NOHW_BATCH_SIZE * 128 == 8 * 8 * sizeof(aes_word_t),
-                      "batch size does not match word size");
-OPENSSL_STATIC_ASSERT(AES_NOHW_WORD_SIZE == sizeof(aes_word_t),
-                      "AES_NOHW_WORD_SIZE is incorrect");
+static_assert(AES_NOHW_BATCH_SIZE * 128 == 8 * 8 * sizeof(aes_word_t),
+              "batch size does not match word size");
+static_assert(AES_NOHW_WORD_SIZE == sizeof(aes_word_t),
+              "AES_NOHW_WORD_SIZE is incorrect");
 
 
 // Block representations.
@@ -1181,29 +1182,27 @@ void aes_nohw_ctr32_encrypt_blocks(const uint8_t *in, uint8_t *out,
   aes_nohw_expand_round_keys(&sched, key);
 
   // Make |AES_NOHW_BATCH_SIZE| copies of |ivec|.
-  alignas(AES_NOHW_WORD_SIZE) union {
-    uint32_t u32[AES_NOHW_BATCH_SIZE * 4];
-    uint8_t u8[AES_NOHW_BATCH_SIZE * 16];
-  } ivs, enc_ivs;
+  alignas(AES_NOHW_WORD_SIZE) uint8_t ivs[AES_NOHW_BATCH_SIZE * 16];
+  alignas(AES_NOHW_WORD_SIZE) uint8_t enc_ivs[AES_NOHW_BATCH_SIZE * 16];
   for (size_t i = 0; i < AES_NOHW_BATCH_SIZE; i++) {
-    memcpy(ivs.u8 + 16 * i, ivec, 16);
+    memcpy(ivs + 16 * i, ivec, 16);
   }
 
-  uint32_t ctr = CRYPTO_bswap4(ivs.u32[3]);
+  uint32_t ctr = CRYPTO_load_u32_be(ivs + 12);
   for (;;) {
     // Update counters.
     for (size_t i = 0; i < AES_NOHW_BATCH_SIZE; i++) {
-      ivs.u32[4 * i + 3] = CRYPTO_bswap4(ctr + i);
+      CRYPTO_store_u32_be(ivs + 16 * i + 12, ctr + (uint32_t)i);
     }
 
     size_t todo = blocks >= AES_NOHW_BATCH_SIZE ? AES_NOHW_BATCH_SIZE : blocks;
     AES_NOHW_BATCH batch;
-    aes_nohw_to_batch(&batch, ivs.u8, todo);
+    aes_nohw_to_batch(&batch, ivs, todo);
     aes_nohw_encrypt_batch(&sched, key->rounds, &batch);
-    aes_nohw_from_batch(enc_ivs.u8, todo, &batch);
+    aes_nohw_from_batch(enc_ivs, todo, &batch);
 
     for (size_t i = 0; i < todo; i++) {
-      aes_nohw_xor_block(out + 16 * i, in + 16 * i, enc_ivs.u8 + 16 * i);
+      aes_nohw_xor_block(out + 16 * i, in + 16 * i, enc_ivs + 16 * i);
     }
 
     blocks -= todo;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/internal.h

@@ -17,7 +17,7 @@
 
 #include <stdlib.h>
 
-#include <openssl/cpu.h>
+#include "../../internal.h"
 
 #if defined(__cplusplus)
 extern "C" {
@@ -30,18 +30,14 @@ extern "C" {
 #define HWAES
 #define HWAES_ECB
 
-OPENSSL_INLINE int hwaes_capable(void) {
-  return (OPENSSL_ia32cap_get()[1] & (1 << (57 - 32))) != 0;
-}
+OPENSSL_INLINE int hwaes_capable(void) { return CRYPTO_is_AESNI_capable(); }
 
 #define VPAES
 #if defined(OPENSSL_X86_64)
 #define VPAES_CTR32
 #endif
 #define VPAES_CBC
-OPENSSL_INLINE int vpaes_capable(void) {
-  return (OPENSSL_ia32cap_get()[1] & (1 << (41 - 32))) != 0;
-}
+OPENSSL_INLINE int vpaes_capable(void) { return CRYPTO_is_SSSE3_capable(); }
 
 #elif defined(OPENSSL_ARM) || defined(OPENSSL_AARCH64)
 #define HWAES
@@ -63,12 +59,6 @@ OPENSSL_INLINE int vpaes_capable(void) { return CRYPTO_is_NEON_capable(); }
 OPENSSL_INLINE int vpaes_capable(void) { return CRYPTO_is_NEON_capable(); }
 #endif
 
-#elif defined(OPENSSL_PPC64LE)
-#define HWAES
-
-OPENSSL_INLINE int hwaes_capable(void) {
-  return CRYPTO_is_PPC64LE_vcrypto_capable();
-}
 #endif
 
 #endif  // !NO_ASM

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/key_wrap.c

@@ -55,6 +55,7 @@
 #include <openssl/mem.h>
 
 #include "../../internal.h"
+#include "../service_indicator/internal.h"
 
 
 // kDefaultIV is the default IV value given in RFC 3394, 2.2.3.1.
@@ -98,6 +99,7 @@ int AES_wrap_key(const AES_KEY *key, const uint8_t *iv, uint8_t *out,
   }
 
   OPENSSL_memcpy(out, A, 8);
+  FIPS_service_indicator_update_state();
   return (int)in_len + 8;
 }
 
@@ -151,6 +153,7 @@ int AES_unwrap_key(const AES_KEY *key, const uint8_t *iv, uint8_t *out,
     return -1;
   }
 
+  FIPS_service_indicator_update_state();
   return (int)in_len - 8;
 }
 
@@ -161,10 +164,8 @@ static const uint8_t kPaddingConstant[4] = {0xa6, 0x59, 0x59, 0xa6};
 int AES_wrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len,
                         size_t max_out, const uint8_t *in, size_t in_len) {
   // See https://tools.ietf.org/html/rfc5649#section-4.1
-  const uint32_t in_len32_be = CRYPTO_bswap4(in_len);
   const uint64_t in_len64 = in_len;
   const size_t padded_len = (in_len + 7) & ~7;
-
   *out_len = 0;
   if (in_len == 0 || in_len64 > 0xffffffffu || in_len + 7 < in_len ||
       padded_len + 8 < padded_len || max_out < padded_len + 8) {
@@ -173,7 +174,7 @@ int AES_wrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len,
 
   uint8_t block[AES_BLOCK_SIZE];
   memcpy(block, kPaddingConstant, sizeof(kPaddingConstant));
-  memcpy(block + 4, &in_len32_be, sizeof(in_len32_be));
+  CRYPTO_store_u32_be(block + 4, (uint32_t)in_len);
 
   if (in_len <= 8) {
     memset(block + 8, 0, 8);
@@ -190,12 +191,15 @@ int AES_wrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len,
   assert(padded_len >= 8);
   memset(padded_in + padded_len - 8, 0, 8);
   memcpy(padded_in, in, in_len);
+  FIPS_service_indicator_lock_state();
   const int ret = AES_wrap_key(key, block, out, padded_in, padded_len);
+  FIPS_service_indicator_unlock_state();
   OPENSSL_free(padded_in);
   if (ret < 0) {
     return 0;
   }
   *out_len = ret;
+  FIPS_service_indicator_update_state();
   return 1;
 }
 
@@ -220,9 +224,7 @@ int AES_unwrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len,
   crypto_word_t ok = constant_time_eq_int(
       CRYPTO_memcmp(iv, kPaddingConstant, sizeof(kPaddingConstant)), 0);
 
-  uint32_t claimed_len32;
-  memcpy(&claimed_len32, iv + 4, sizeof(claimed_len32));
-  const size_t claimed_len = CRYPTO_bswap4(claimed_len32);
+  const size_t claimed_len = CRYPTO_load_u32_be(iv + 4);
   ok &= ~constant_time_is_zero_w(claimed_len);
   ok &= constant_time_eq_w((claimed_len - 1) >> 3, (in_len - 9) >> 3);
 
@@ -232,5 +234,9 @@ int AES_unwrap_key_padded(const AES_KEY *key, uint8_t *out, size_t *out_len,
   }
 
   *out_len = constant_time_select_w(ok, claimed_len, 0);
-  return ok & 1;
+  const int ret = ok & 1;
+  if (ret) {
+    FIPS_service_indicator_update_state();
+  }
+  return ret;
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/aes/mode_wrappers.c

@@ -52,6 +52,7 @@
 
 #include "../aes/internal.h"
 #include "../modes/internal.h"
+#include "../service_indicator/internal.h"
 
 
 void AES_ctr128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
@@ -74,6 +75,8 @@ void AES_ctr128_encrypt(const uint8_t *in, uint8_t *out, size_t len,
     CRYPTO_ctr128_encrypt_ctr32(in, out, len, key, ivec, ecount_buf, num,
                                 aes_nohw_ctr32_encrypt_blocks);
   }
+
+  FIPS_service_indicator_update_state();
 }
 
 void AES_ecb_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key,
@@ -86,24 +89,23 @@ void AES_ecb_encrypt(const uint8_t *in, uint8_t *out, const AES_KEY *key,
   } else {
     AES_decrypt(in, out, key);
   }
+
+  FIPS_service_indicator_update_state();
 }
 
 void AES_cbc_encrypt(const uint8_t *in, uint8_t *out, size_t len,
                      const AES_KEY *key, uint8_t *ivec, const int enc) {
   if (hwaes_capable()) {
     aes_hw_cbc_encrypt(in, out, len, key, ivec, enc);
-    return;
-  }
-
-  if (!vpaes_capable()) {
+  } else if (!vpaes_capable()) {
     aes_nohw_cbc_encrypt(in, out, len, key, ivec, enc);
-    return;
-  }
-  if (enc) {
+  } else if (enc) {
     CRYPTO_cbc128_encrypt(in, out, len, key, ivec, AES_encrypt);
   } else {
     CRYPTO_cbc128_decrypt(in, out, len, key, ivec, AES_decrypt);
   }
+
+  FIPS_service_indicator_update_state();
 }
 
 void AES_ofb128_encrypt(const uint8_t *in, uint8_t *out, size_t length,

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bcm.c

@@ -58,12 +58,13 @@
 #include "cipher/aead.c"
 #include "cipher/cipher.c"
 #include "cipher/e_aes.c"
-#include "cipher/e_des.c"
-#include "des/des.c"
+#include "cipher/e_aesccm.c"
+#include "cmac/cmac.c"
 #include "dh/check.c"
 #include "dh/dh.c"
 #include "digest/digest.c"
 #include "digest/digests.c"
+#include "digestsign/digestsign.c"
 #include "ecdh/ecdh.c"
 #include "ecdsa/ecdsa.c"
 #include "ec/ec.c"
@@ -73,12 +74,13 @@
 #include "ec/oct.c"
 #include "ec/p224-64.c"
 #include "ec/p256.c"
-#include "ec/p256-x86_64.c"
+#include "ec/p256-nistz.c"
 #include "ec/scalar.c"
 #include "ec/simple.c"
 #include "ec/simple_mul.c"
 #include "ec/util.c"
 #include "ec/wnaf.c"
+#include "hkdf/hkdf.c"
 #include "hmac/hmac.c"
 #include "md4/md4.c"
 #include "md5/md5.c"
@@ -99,7 +101,7 @@
 #include "rsa/rsa_impl.c"
 #include "self_check/fips.c"
 #include "self_check/self_check.c"
-#include "sha/sha1-altivec.c"
+#include "service_indicator/service_indicator.c"
 #include "sha/sha1.c"
 #include "sha/sha256.c"
 #include "sha/sha512.c"
@@ -171,6 +173,23 @@ BORINGSSL_bcm_power_on_self_test(void) {
 #if !defined(OPENSSL_ASAN)
   // Integrity tests cannot run under ASAN because it involves reading the full
   // .text section, which triggers the global-buffer overflow detection.
+  if (!BORINGSSL_integrity_test()) {
+    goto err;
+  }
+#endif  // OPENSSL_ASAN
+
+  if (!boringssl_self_test_startup()) {
+    goto err;
+  }
+
+  return;
+
+err:
+  BORINGSSL_FIPS_abort();
+}
+
+#if !defined(OPENSSL_ASAN)
+int BORINGSSL_integrity_test(void) {
   const uint8_t *const start = BORINGSSL_bcm_text_start;
   const uint8_t *const end = BORINGSSL_bcm_text_end;
 
@@ -192,17 +211,15 @@ BORINGSSL_bcm_power_on_self_test(void) {
 #endif
 
   assert_within(rodata_start, kPrimes, rodata_end);
-  assert_within(rodata_start, des_skb, rodata_end);
-  assert_within(rodata_start, kP256Params, rodata_end);
+  assert_within(rodata_start, kP256Field, rodata_end);
   assert_within(rodata_start, kPKCS1SigPrefixes, rodata_end);
 
-#if defined(OPENSSL_AARCH64) || defined(OPENSSL_ANDROID)
   uint8_t result[SHA256_DIGEST_LENGTH];
   const EVP_MD *const kHashFunction = EVP_sha256();
-#else
-  uint8_t result[SHA512_DIGEST_LENGTH];
-  const EVP_MD *const kHashFunction = EVP_sha512();
-#endif
+  if (!boringssl_self_test_sha256() ||
+      !boringssl_self_test_hmac_sha256()) {
+    return 0;
+  }
 
   static const uint8_t kHMACKey[64] = {0};
   unsigned result_len;
@@ -211,7 +228,7 @@ BORINGSSL_bcm_power_on_self_test(void) {
   if (!HMAC_Init_ex(&hmac_ctx, kHMACKey, sizeof(kHMACKey), kHashFunction,
                     NULL /* no ENGINE */)) {
     fprintf(stderr, "HMAC_Init_ex failed.\n");
-    goto err;
+    return 0;
   }
 
   BORINGSSL_maybe_set_module_text_permissions(PROT_READ | PROT_EXEC);
@@ -231,30 +248,22 @@ BORINGSSL_bcm_power_on_self_test(void) {
   if (!HMAC_Final(&hmac_ctx, result, &result_len) ||
       result_len != sizeof(result)) {
     fprintf(stderr, "HMAC failed.\n");
-    goto err;
+    return 0;
   }
-  HMAC_CTX_cleanup(&hmac_ctx);
+  HMAC_CTX_cleanse(&hmac_ctx); // FIPS 140-3, AS05.10.
 
   const uint8_t *expected = BORINGSSL_bcm_text_hash;
 
   if (!check_test(expected, result, sizeof(result), "FIPS integrity test")) {
-    goto err;
-  }
-
-  if (!boringssl_fips_self_test(BORINGSSL_bcm_text_hash, sizeof(result))) {
-    goto err;
-  }
-#else
-  if (!BORINGSSL_self_test()) {
-    goto err;
+#if !defined(BORINGSSL_FIPS_BREAK_TESTS)
+    return 0;
+#endif
   }
-#endif  // OPENSSL_ASAN
-
-  return;
 
-err:
-  BORINGSSL_FIPS_abort();
+  OPENSSL_cleanse(result, sizeof(result)); // FIPS 140-3, AS05.10.
+  return 1;
 }
+#endif  // OPENSSL_ASAN
 
 void BORINGSSL_FIPS_abort(void) {
   for (;;) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/bn.c

@@ -56,6 +56,7 @@
 
 #include <openssl/bn.h>
 
+#include <assert.h>
 #include <limits.h>
 #include <string.h>
 
@@ -66,11 +67,15 @@
 #include "../delocate.h"
 
 
+// BN_MAX_WORDS is the maximum number of words allowed in a |BIGNUM|. It is
+// sized so byte and bit counts of a |BIGNUM| always fit in |int|, with room to
+// spare.
+#define BN_MAX_WORDS (INT_MAX / (4 * BN_BITS2))
+
 BIGNUM *BN_new(void) {
   BIGNUM *bn = OPENSSL_malloc(sizeof(BIGNUM));
 
   if (bn == NULL) {
-    OPENSSL_PUT_ERROR(BN, ERR_R_MALLOC_FAILURE);
     return NULL;
   }
 
@@ -80,6 +85,8 @@ BIGNUM *BN_new(void) {
   return bn;
 }
 
+BIGNUM *BN_secure_new(void) { return BN_new(); }
+
 void BN_init(BIGNUM *bn) {
   OPENSSL_memset(bn, 0, sizeof(BIGNUM));
 }
@@ -289,8 +296,9 @@ void bn_set_static_words(BIGNUM *bn, const BN_ULONG *words, size_t num) {
   }
   bn->d = (BN_ULONG *)words;
 
-  bn->width = num;
-  bn->dmax = num;
+  assert(num <= BN_MAX_WORDS);
+  bn->width = (int)num;
+  bn->dmax = (int)num;
   bn->neg = 0;
   bn->flags |= BN_FLG_STATIC_DATA;
 }
@@ -343,7 +351,7 @@ int bn_wexpand(BIGNUM *bn, size_t words) {
     return 1;
   }
 
-  if (words > (INT_MAX / (4 * BN_BITS2))) {
+  if (words > BN_MAX_WORDS) {
     OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG);
     return 0;
   }
@@ -355,7 +363,6 @@ int bn_wexpand(BIGNUM *bn, size_t words) {
 
   a = OPENSSL_malloc(sizeof(BN_ULONG) * words);
   if (a == NULL) {
-    OPENSSL_PUT_ERROR(BN, ERR_R_MALLOC_FAILURE);
     return 0;
   }
 
@@ -377,30 +384,13 @@ int bn_expand(BIGNUM *bn, size_t bits) {
 }
 
 int bn_resize_words(BIGNUM *bn, size_t words) {
-#if defined(OPENSSL_PPC64LE)
-  // This is a workaround for a miscompilation bug in Clang 7.0.1 on POWER.
-  // The unittests catch the miscompilation, if it occurs, and it manifests
-  // as a crash in |bn_fits_in_words|.
-  //
-  // The bug only triggers if building in FIPS mode and with -O3. Clang 8.0.1
-  // has the same bug but this workaround is not effective there---I've not
-  // been able to find a workaround for 8.0.1.
-  //
-  // At the time of writing (2019-08-08), Clang git does *not* have this bug
-  // and does not need this workaroud. The current git version should go on to
-  // be Clang 10 thus, once we can depend on that, this can be removed.
-  if (value_barrier_w((size_t)bn->width == words)) {
-    return 1;
-  }
-#endif
-
   if ((size_t)bn->width <= words) {
     if (!bn_wexpand(bn, words)) {
       return 0;
     }
     OPENSSL_memset(bn->d + bn->width, 0,
                    (words - bn->width) * sizeof(BN_ULONG));
-    bn->width = words;
+    bn->width = (int)words;
     return 1;
   }
 
@@ -409,15 +399,15 @@ int bn_resize_words(BIGNUM *bn, size_t words) {
     OPENSSL_PUT_ERROR(BN, BN_R_BIGNUM_TOO_LONG);
     return 0;
   }
-  bn->width = words;
+  bn->width = (int)words;
   return 1;
 }
 
 void bn_select_words(BN_ULONG *r, BN_ULONG mask, const BN_ULONG *a,
                      const BN_ULONG *b, size_t num) {
   for (size_t i = 0; i < num; i++) {
-    OPENSSL_STATIC_ASSERT(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
-                          "crypto_word_t is too small");
+    static_assert(sizeof(BN_ULONG) <= sizeof(crypto_word_t),
+                  "crypto_word_t is too small");
     r[i] = constant_time_select_w(mask, a[i], b[i]);
   }
 }