grpc 1.53.0 → 1.58.0

data/third_party/boringssl-with-bazel/src/crypto/pkcs8/internal.h

@@ -87,13 +87,13 @@ int pkcs8_pbe_decrypt(uint8_t **out, size_t *out_len, CBS *algorithm,
 // key material to |out| and returns one. Otherwise, it returns zero. |id|
 // should be one of the |PKCS12_*_ID| values.
 int pkcs12_key_gen(const char *pass, size_t pass_len, const uint8_t *salt,
-                   size_t salt_len, uint8_t id, unsigned iterations,
+                   size_t salt_len, uint8_t id, uint32_t iterations,
                    size_t out_len, uint8_t *out, const EVP_MD *md);
 
 // pkcs12_pbe_encrypt_init configures |ctx| for encrypting with a PBES1 scheme
 // defined in PKCS#12. It writes the corresponding AlgorithmIdentifier to |out|.
 int pkcs12_pbe_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx, int alg,
-                            unsigned iterations, const char *pass,
+                            uint32_t iterations, const char *pass,
                             size_t pass_len, const uint8_t *salt,
                             size_t salt_len);
 
@@ -121,7 +121,7 @@ int PKCS5_pbe2_decrypt_init(const struct pbe_suite *suite, EVP_CIPHER_CTX *ctx,
 // as defined in RFC 2998, with the specified parameters. It writes the
 // corresponding AlgorithmIdentifier to |out|.
 int PKCS5_pbe2_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx,
-                            const EVP_CIPHER *cipher, unsigned iterations,
+                            const EVP_CIPHER *cipher, uint32_t iterations,
                             const char *pass, size_t pass_len,
                             const uint8_t *salt, size_t salt_len);
 

data/third_party/boringssl-with-bazel/src/crypto/pkcs8/p5_pbev2.c

@@ -144,7 +144,7 @@ static int add_cipher_oid(CBB *out, int nid) {
 }
 
 static int pkcs5_pbe2_cipher_init(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
-                                  const EVP_MD *pbkdf2_md, unsigned iterations,
+                                  const EVP_MD *pbkdf2_md, uint32_t iterations,
                                   const char *pass, size_t pass_len,
                                   const uint8_t *salt, size_t salt_len,
                                   const uint8_t *iv, size_t iv_len, int enc) {
@@ -162,7 +162,7 @@ static int pkcs5_pbe2_cipher_init(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
 }
 
 int PKCS5_pbe2_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx,
-                            const EVP_CIPHER *cipher, unsigned iterations,
+                            const EVP_CIPHER *cipher, uint32_t iterations,
                             const char *pass, size_t pass_len,
                             const uint8_t *salt, size_t salt_len) {
   int cipher_nid = EVP_CIPHER_nid(cipher);
@@ -310,7 +310,7 @@ int PKCS5_pbe2_decrypt_init(const struct pbe_suite *suite, EVP_CIPHER_CTX *ctx,
     return 0;
   }
 
-  return pkcs5_pbe2_cipher_init(ctx, cipher, md, (unsigned)iterations, pass,
+  return pkcs5_pbe2_cipher_init(ctx, cipher, md, (uint32_t)iterations, pass,
                                 pass_len, CBS_data(&salt), CBS_len(&salt),
                                 CBS_data(&iv), CBS_len(&iv), 0 /* decrypt */);
 }

data/third_party/boringssl-with-bazel/src/crypto/pkcs8/pkcs8.c

@@ -76,7 +76,6 @@ static int pkcs12_encode_password(const char *in, size_t in_len, uint8_t **out,
                                   size_t *out_len) {
   CBB cbb;
   if (!CBB_init(&cbb, in_len * 2)) {
-    OPENSSL_PUT_ERROR(PKCS8, ERR_R_MALLOC_FAILURE);
     return 0;
   }
 
@@ -107,7 +106,7 @@ err:
 }
 
 int pkcs12_key_gen(const char *pass, size_t pass_len, const uint8_t *salt,
-                   size_t salt_len, uint8_t id, unsigned iterations,
+                   size_t salt_len, uint8_t id, uint32_t iterations,
                    size_t out_len, uint8_t *out, const EVP_MD *md) {
   // See https://tools.ietf.org/html/rfc7292#appendix-B. Quoted parts of the
   // specification have errata applied and other typos fixed.
@@ -162,7 +161,6 @@ int pkcs12_key_gen(const char *pass, size_t pass_len, const uint8_t *salt,
 
   I = OPENSSL_malloc(I_len);
   if (I_len != 0 && I == NULL) {
-    OPENSSL_PUT_ERROR(PKCS8, ERR_R_MALLOC_FAILURE);
     goto err;
   }
 
@@ -184,7 +182,7 @@ int pkcs12_key_gen(const char *pass, size_t pass_len, const uint8_t *salt,
         !EVP_DigestFinal_ex(&ctx, A, &A_len)) {
       goto err;
     }
-    for (unsigned iter = 1; iter < iterations; iter++) {
+    for (uint32_t iter = 1; iter < iterations; iter++) {
       if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
           !EVP_DigestUpdate(&ctx, A, A_len) ||
           !EVP_DigestFinal_ex(&ctx, A, &A_len)) {
@@ -231,7 +229,7 @@ err:
 }
 
 static int pkcs12_pbe_cipher_init(const struct pbe_suite *suite,
-                                  EVP_CIPHER_CTX *ctx, unsigned iterations,
+                                  EVP_CIPHER_CTX *ctx, uint32_t iterations,
                                   const char *pass, size_t pass_len,
                                   const uint8_t *salt, size_t salt_len,
                                   int is_encrypt) {
@@ -273,7 +271,7 @@ static int pkcs12_pbe_decrypt_init(const struct pbe_suite *suite,
     return 0;
   }
 
-  return pkcs12_pbe_cipher_init(suite, ctx, (unsigned)iterations, pass,
+  return pkcs12_pbe_cipher_init(suite, ctx, (uint32_t)iterations, pass,
                                 pass_len, CBS_data(&salt), CBS_len(&salt),
                                 0 /* decrypt */);
 }
@@ -331,7 +329,7 @@ static const struct pbe_suite *get_pkcs12_pbe_suite(int pbe_nid) {
 }
 
 int pkcs12_pbe_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx, int alg,
-                            unsigned iterations, const char *pass,
+                            uint32_t iterations, const char *pass,
                             size_t pass_len, const uint8_t *salt,
                             size_t salt_len) {
   const struct pbe_suite *suite = get_pkcs12_pbe_suite(alg);
@@ -390,7 +388,6 @@ int pkcs8_pbe_decrypt(uint8_t **out, size_t *out_len, CBS *algorithm,
 
   buf = OPENSSL_malloc(in_len);
   if (buf == NULL) {
-    OPENSSL_PUT_ERROR(PKCS8, ERR_R_MALLOC_FAILURE);
     goto err;
   }
 
@@ -492,10 +489,10 @@ int PKCS8_marshal_encrypted_private_key(CBB *out, int pbe_nid,
   // it. See 5693a30813a031d3921a016a870420e7eb93ec90 in OpenSSL.
   int alg_ok;
   if (pbe_nid == -1) {
-    alg_ok = PKCS5_pbe2_encrypt_init(&epki, &ctx, cipher, (unsigned)iterations,
+    alg_ok = PKCS5_pbe2_encrypt_init(&epki, &ctx, cipher, (uint32_t)iterations,
                                      pass, pass_len, salt, salt_len);
   } else {
-    alg_ok = pkcs12_pbe_encrypt_init(&epki, &ctx, pbe_nid, (unsigned)iterations,
+    alg_ok = pkcs12_pbe_encrypt_init(&epki, &ctx, pbe_nid, (uint32_t)iterations,
                                      pass, pass_len, salt, salt_len);
   }
   if (!alg_ok) {

data/third_party/boringssl-with-bazel/src/crypto/pkcs8/pkcs8_x509.c

@@ -87,65 +87,20 @@ int pkcs12_iterations_acceptable(uint64_t iterations) {
   static const uint64_t kIterationsLimit = 100 * 1000000;
 #endif
 
+  assert(kIterationsLimit <= UINT32_MAX);
   return 0 < iterations && iterations <= kIterationsLimit;
 }
 
-// Minor tweak to operation: zero private key data
-static int pkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
-                   void *exarg) {
-  // Since the structure must still be valid use ASN1_OP_FREE_PRE
-  if (operation == ASN1_OP_FREE_PRE) {
-    PKCS8_PRIV_KEY_INFO *key = (PKCS8_PRIV_KEY_INFO *)*pval;
-    if (key->pkey) {
-      OPENSSL_cleanse(key->pkey->data, key->pkey->length);
-    }
-  }
-  return 1;
-}
+ASN1_SEQUENCE(PKCS8_PRIV_KEY_INFO) = {
+    ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, version, ASN1_INTEGER),
+    ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, pkeyalg, X509_ALGOR),
+    ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, pkey, ASN1_OCTET_STRING),
+    ASN1_IMP_SET_OF_OPT(PKCS8_PRIV_KEY_INFO, attributes, X509_ATTRIBUTE, 0),
+} ASN1_SEQUENCE_END(PKCS8_PRIV_KEY_INFO)
 
-ASN1_SEQUENCE_cb(PKCS8_PRIV_KEY_INFO, pkey_cb) = {
-  ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, version, ASN1_INTEGER),
-  ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, pkeyalg, X509_ALGOR),
-  ASN1_SIMPLE(PKCS8_PRIV_KEY_INFO, pkey, ASN1_OCTET_STRING),
-  ASN1_IMP_SET_OF_OPT(PKCS8_PRIV_KEY_INFO, attributes, X509_ATTRIBUTE, 0)
-} ASN1_SEQUENCE_END_cb(PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO)
-
-IMPLEMENT_ASN1_FUNCTIONS(PKCS8_PRIV_KEY_INFO)
-
-int PKCS8_pkey_set0(PKCS8_PRIV_KEY_INFO *priv, ASN1_OBJECT *aobj, int version,
-                    int ptype, void *pval, uint8_t *penc, int penclen) {
-  if (version >= 0 &&
-      !ASN1_INTEGER_set(priv->version, version)) {
-    return 0;
-  }
+IMPLEMENT_ASN1_FUNCTIONS_const(PKCS8_PRIV_KEY_INFO)
 
-  if (!X509_ALGOR_set0(priv->pkeyalg, aobj, ptype, pval)) {
-    return 0;
-  }
-
-  if (penc != NULL) {
-    ASN1_STRING_set0(priv->pkey, penc, penclen);
-  }
-
-  return 1;
-}
-
-int PKCS8_pkey_get0(ASN1_OBJECT **ppkalg, const uint8_t **pk, int *ppklen,
-                    X509_ALGOR **pa, PKCS8_PRIV_KEY_INFO *p8) {
-  if (ppkalg) {
-    *ppkalg = p8->pkeyalg->algorithm;
-  }
-  if (pk) {
-    *pk = ASN1_STRING_data(p8->pkey);
-    *ppklen = ASN1_STRING_length(p8->pkey);
-  }
-  if (pa) {
-    *pa = p8->pkeyalg;
-  }
-  return 1;
-}
-
-EVP_PKEY *EVP_PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8) {
+EVP_PKEY *EVP_PKCS82PKEY(const PKCS8_PRIV_KEY_INFO *p8) {
   uint8_t *der = NULL;
   int der_len = i2d_PKCS8_PRIV_KEY_INFO(p8, &der);
   if (der_len < 0) {
@@ -166,7 +121,7 @@ EVP_PKEY *EVP_PKCS82PKEY(PKCS8_PRIV_KEY_INFO *p8) {
   return ret;
 }
 
-PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(EVP_PKEY *pkey) {
+PKCS8_PRIV_KEY_INFO *EVP_PKEY2PKCS8(const EVP_PKEY *pkey) {
   CBB cbb;
   uint8_t *der = NULL;
   size_t der_len;
@@ -380,7 +335,6 @@ static int parse_bag_attributes(CBS *attrs, uint8_t **out_friendly_name,
       // Convert the friendly name to UTF-8.
       CBB cbb;
       if (!CBB_init(&cbb, CBS_len(&value))) {
-        OPENSSL_PUT_ERROR(PKCS8, ERR_R_MALLOC_FAILURE);
         goto err;
       }
       while (CBS_len(&value) != 0) {
@@ -393,7 +347,6 @@ static int parse_bag_attributes(CBS *attrs, uint8_t **out_friendly_name,
         }
       }
       if (!CBB_finish(&cbb, out_friendly_name, out_friendly_name_len)) {
-        OPENSSL_PUT_ERROR(PKCS8, ERR_R_MALLOC_FAILURE);
         CBB_cleanup(&cbb);
         goto err;
       }
@@ -602,7 +555,7 @@ err:
 
 static int pkcs12_check_mac(int *out_mac_ok, const char *password,
                             size_t password_len, const CBS *salt,
-                            unsigned iterations, const EVP_MD *md,
+                            uint32_t iterations, const EVP_MD *md,
                             const CBS *authsafes, const CBS *expected_mac) {
   int ret = 0;
   uint8_t hmac_key[EVP_MAX_MD_SIZE];
@@ -724,13 +677,15 @@ int PKCS12_get_key_and_certs(EVP_PKEY **out_key, STACK_OF(X509) *out_certs,
     }
 
     // The iteration count is optional and the default is one.
-    uint64_t iterations = 1;
+    uint32_t iterations = 1;
     if (CBS_len(&mac_data) > 0) {
-      if (!CBS_get_asn1_uint64(&mac_data, &iterations) ||
-          !pkcs12_iterations_acceptable(iterations)) {
+      uint64_t iterations_u64;
+      if (!CBS_get_asn1_uint64(&mac_data, &iterations_u64) ||
+          !pkcs12_iterations_acceptable(iterations_u64)) {
         OPENSSL_PUT_ERROR(PKCS8, PKCS8_R_BAD_PKCS12_DATA);
         goto err;
       }
+      iterations = (uint32_t)iterations_u64;
     }
 
     int mac_ok;
@@ -828,7 +783,9 @@ PKCS12* d2i_PKCS12_bio(BIO *bio, PKCS12 **out_p12) {
   }
 
   for (;;) {
-    int n = BIO_read(bio, &buf->data[used], buf->length - used);
+    size_t max_read = buf->length - used;
+    int n = BIO_read(bio, &buf->data[used],
+                     max_read > INT_MAX ? INT_MAX : (int)max_read);
     if (n < 0) {
       if (used == 0) {
         goto out;
@@ -888,7 +845,6 @@ int i2d_PKCS12(const PKCS12 *p12, uint8_t **out) {
   if (*out == NULL) {
     *out = OPENSSL_malloc(p12->ber_len);
     if (*out == NULL) {
-      OPENSSL_PUT_ERROR(PKCS8, ERR_R_MALLOC_FAILURE);
       return -1;
     }
     OPENSSL_memcpy(*out, p12->ber_bytes, p12->ber_len);
@@ -927,7 +883,6 @@ int PKCS12_parse(const PKCS12 *p12, const char *password, EVP_PKEY **out_pkey,
   if (!ca_certs) {
     ca_certs = sk_X509_new_null();
     if (ca_certs == NULL) {
-      OPENSSL_PUT_ERROR(PKCS8, ERR_R_MALLOC_FAILURE);
       return 0;
     }
     ca_certs_alloced = 1;
@@ -993,8 +948,8 @@ int PKCS12_verify_mac(const PKCS12 *p12, const char *password,
 
 // add_bag_attributes adds the bagAttributes field of a SafeBag structure,
 // containing the specified friendlyName and localKeyId attributes.
-static int add_bag_attributes(CBB *bag, const char *name, const uint8_t *key_id,
-                              size_t key_id_len) {
+static int add_bag_attributes(CBB *bag, const char *name, size_t name_len,
+                              const uint8_t *key_id, size_t key_id_len) {
   if (name == NULL && key_id_len == 0) {
     return 1;  // Omit the OPTIONAL SET.
   }
@@ -1003,7 +958,7 @@ static int add_bag_attributes(CBB *bag, const char *name, const uint8_t *key_id,
   if (!CBB_add_asn1(bag, &attrs, CBS_ASN1_SET)) {
     return 0;
   }
-  if (name != NULL) {
+  if (name_len != 0) {
     // See https://tools.ietf.org/html/rfc2985, section 5.5.1.
     if (!CBB_add_asn1(&attrs, &attr, CBS_ASN1_SEQUENCE) ||
         !CBB_add_asn1(&attr, &oid, CBS_ASN1_OBJECT) ||
@@ -1014,7 +969,7 @@ static int add_bag_attributes(CBB *bag, const char *name, const uint8_t *key_id,
     }
     // Convert the friendly name to a BMPString.
     CBS name_cbs;
-    CBS_init(&name_cbs, (const uint8_t *)name, strlen(name));
+    CBS_init(&name_cbs, (const uint8_t *)name, name_len);
     while (CBS_len(&name_cbs) != 0) {
       uint32_t c;
       if (!cbs_get_utf8(&name_cbs, &c) ||
@@ -1059,10 +1014,24 @@ static int add_cert_bag(CBB *cbb, X509 *cert, const char *name,
   }
   uint8_t *buf;
   int len = i2d_X509(cert, NULL);
+
+  int int_name_len = 0;
+  const char *cert_name = (const char *)X509_alias_get0(cert, &int_name_len);
+  size_t name_len = int_name_len;
+  if (name) {
+    if (name_len != 0) {
+      OPENSSL_PUT_ERROR(PKCS8, PKCS8_R_AMBIGUOUS_FRIENDLY_NAME);
+      return 0;
+    }
+    name_len = strlen(name);
+  } else {
+    name = cert_name;
+  }
+
   if (len < 0 ||
       !CBB_add_space(&cert_value, &buf, (size_t)len) ||
       i2d_X509(cert, &buf) < 0 ||
-      !add_bag_attributes(&bag, name, key_id, key_id_len) ||
+      !add_bag_attributes(&bag, name, name_len, key_id, key_id_len) ||
       !CBB_flush(cbb)) {
     return 0;
   }
@@ -1090,7 +1059,7 @@ static int add_cert_safe_contents(CBB *cbb, X509 *cert,
 }
 
 static int add_encrypted_data(CBB *out, int pbe_nid, const char *password,
-                              size_t password_len, unsigned iterations,
+                              size_t password_len, uint32_t iterations,
                               const uint8_t *in, size_t in_len) {
   uint8_t salt[PKCS5_SALT_LEN];
   if (!RAND_bytes(salt, sizeof(salt))) {
@@ -1323,7 +1292,11 @@ PKCS12 *PKCS12_create(const char *password, const char *name,
         goto err;
       }
     }
-    if (!add_bag_attributes(&bag, name, key_id, key_id_len) ||
+    size_t name_len = 0;
+    if (name) {
+      name_len = strlen(name);
+    }
+    if (!add_bag_attributes(&bag, name, name_len, key_id, key_id_len) ||
         !CBB_flush(&content_infos)) {
       goto err;
     }

data/third_party/boringssl-with-bazel/src/crypto/poly1305/poly1305.c

@@ -18,27 +18,15 @@
 
 #include <openssl/poly1305.h>
 
+#include <assert.h>
 #include <string.h>
 
-#include <openssl/cpu.h>
-
 #include "internal.h"
 #include "../internal.h"
 
 
 #if !defined(BORINGSSL_HAS_UINT128) || !defined(OPENSSL_X86_64)
 
-// We can assume little-endian.
-static uint32_t U8TO32_LE(const uint8_t *m) {
-  uint32_t r;
-  OPENSSL_memcpy(&r, m, sizeof(r));
-  return r;
-}
-
-static void U32TO8_LE(uint8_t *m, uint32_t v) {
-  OPENSSL_memcpy(m, &v, sizeof(v));
-}
-
 static uint64_t mul32x32_64(uint32_t a, uint32_t b) { return (uint64_t)a * b; }
 
 struct poly1305_state_st {
@@ -50,7 +38,7 @@ struct poly1305_state_st {
   uint8_t key[16];
 };
 
-OPENSSL_STATIC_ASSERT(
+static_assert(
     sizeof(struct poly1305_state_st) + 63 <= sizeof(poly1305_state),
     "poly1305_state isn't large enough to hold aligned poly1305_state_st");
 
@@ -76,10 +64,10 @@ static void poly1305_update(struct poly1305_state_st *state, const uint8_t *in,
   }
 
 poly1305_donna_16bytes:
-  t0 = U8TO32_LE(in);
-  t1 = U8TO32_LE(in + 4);
-  t2 = U8TO32_LE(in + 8);
-  t3 = U8TO32_LE(in + 12);
+  t0 = CRYPTO_load_u32_le(in);
+  t1 = CRYPTO_load_u32_le(in + 4);
+  t2 = CRYPTO_load_u32_le(in + 8);
+  t3 = CRYPTO_load_u32_le(in + 12);
 
   in += 16;
   len -= 16;
@@ -142,10 +130,10 @@ poly1305_donna_atmost15bytes:
   }
   len = 0;
 
-  t0 = U8TO32_LE(mp + 0);
-  t1 = U8TO32_LE(mp + 4);
-  t2 = U8TO32_LE(mp + 8);
-  t3 = U8TO32_LE(mp + 12);
+  t0 = CRYPTO_load_u32_le(mp + 0);
+  t1 = CRYPTO_load_u32_le(mp + 4);
+  t2 = CRYPTO_load_u32_le(mp + 8);
+  t3 = CRYPTO_load_u32_le(mp + 12);
 
   state->h0 += t0 & 0x3ffffff;
   state->h1 += ((((uint64_t)t1 << 32) | t0) >> 26) & 0x3ffffff;
@@ -167,10 +155,10 @@ void CRYPTO_poly1305_init(poly1305_state *statep, const uint8_t key[32]) {
   }
 #endif
 
-  t0 = U8TO32_LE(key + 0);
-  t1 = U8TO32_LE(key + 4);
-  t2 = U8TO32_LE(key + 8);
-  t3 = U8TO32_LE(key + 12);
+  t0 = CRYPTO_load_u32_le(key + 0);
+  t1 = CRYPTO_load_u32_le(key + 4);
+  t2 = CRYPTO_load_u32_le(key + 8);
+  t3 = CRYPTO_load_u32_le(key + 12);
 
   // precompute multipliers
   state->r0 = t0 & 0x3ffffff;
@@ -206,6 +194,11 @@ void CRYPTO_poly1305_update(poly1305_state *statep, const uint8_t *in,
                             size_t in_len) {
   struct poly1305_state_st *state = poly1305_aligned_state(statep);
 
+  // Work around a C language bug. See https://crbug.com/1019588.
+  if (in_len == 0) {
+    return;
+  }
+
 #if defined(OPENSSL_POLY1305_NEON)
   if (CRYPTO_is_NEON_capable()) {
     CRYPTO_poly1305_update_neon(statep, in, in_len);
@@ -248,7 +241,6 @@ void CRYPTO_poly1305_update(poly1305_state *statep, const uint8_t *in,
 
 void CRYPTO_poly1305_finish(poly1305_state *statep, uint8_t mac[16]) {
   struct poly1305_state_st *state = poly1305_aligned_state(statep);
-  uint64_t f0, f1, f2, f3;
   uint32_t g0, g1, g2, g3, g4;
   uint32_t b, nb;
 
@@ -301,21 +293,22 @@ void CRYPTO_poly1305_finish(poly1305_state *statep, uint8_t mac[16]) {
   state->h3 = (state->h3 & nb) | (g3 & b);
   state->h4 = (state->h4 & nb) | (g4 & b);
 
-  f0 = ((state->h0) | (state->h1 << 26)) + (uint64_t)U8TO32_LE(&state->key[0]);
-  f1 = ((state->h1 >> 6) | (state->h2 << 20)) +
-       (uint64_t)U8TO32_LE(&state->key[4]);
-  f2 = ((state->h2 >> 12) | (state->h3 << 14)) +
-       (uint64_t)U8TO32_LE(&state->key[8]);
-  f3 = ((state->h3 >> 18) | (state->h4 << 8)) +
-       (uint64_t)U8TO32_LE(&state->key[12]);
+  uint64_t f0 = ((state->h0) | (state->h1 << 26)) +
+                (uint64_t)CRYPTO_load_u32_le(&state->key[0]);
+  uint64_t f1 = ((state->h1 >> 6) | (state->h2 << 20)) +
+                (uint64_t)CRYPTO_load_u32_le(&state->key[4]);
+  uint64_t f2 = ((state->h2 >> 12) | (state->h3 << 14)) +
+                (uint64_t)CRYPTO_load_u32_le(&state->key[8]);
+  uint64_t f3 = ((state->h3 >> 18) | (state->h4 << 8)) +
+                (uint64_t)CRYPTO_load_u32_le(&state->key[12]);
 
-  U32TO8_LE(&mac[0], f0);
+  CRYPTO_store_u32_le(&mac[0], (uint32_t)f0);
   f1 += (f0 >> 32);
-  U32TO8_LE(&mac[4], f1);
+  CRYPTO_store_u32_le(&mac[4], (uint32_t)f1);
   f2 += (f1 >> 32);
-  U32TO8_LE(&mac[8], f2);
+  CRYPTO_store_u32_le(&mac[8], (uint32_t)f2);
   f3 += (f2 >> 32);
-  U32TO8_LE(&mac[12], f3);
+  CRYPTO_store_u32_le(&mac[12], (uint32_t)f3);
 }
 
 #endif  // !BORINGSSL_HAS_UINT128 || !OPENSSL_X86_64

data/third_party/boringssl-with-bazel/src/crypto/poly1305/poly1305_arm.c

@@ -17,6 +17,7 @@
 
 #include <openssl/poly1305.h>
 
+#include <assert.h>
 #include <string.h>
 
 #include "../internal.h"
@@ -183,7 +184,7 @@ struct poly1305_state_st {
   uint8_t key[16];
 };
 
-OPENSSL_STATIC_ASSERT(
+static_assert(
     sizeof(struct poly1305_state_st) + 63 <= sizeof(poly1305_state),
     "poly1305_state isn't large enough to hold aligned poly1305_state_st.");
 

data/third_party/boringssl-with-bazel/src/crypto/poly1305/poly1305_vec.c

@@ -20,6 +20,8 @@
 
 #include <openssl/poly1305.h>
 
+#include <assert.h>
+
 #include "../internal.h"
 
 
@@ -27,22 +29,6 @@
 
 #include <emmintrin.h>
 
-static uint32_t load_u32_le(const uint8_t in[4]) {
-  uint32_t ret;
-  OPENSSL_memcpy(&ret, in, 4);
-  return ret;
-}
-
-static uint64_t load_u64_le(const uint8_t in[8]) {
-  uint64_t ret;
-  OPENSSL_memcpy(&ret, in, 8);
-  return ret;
-}
-
-static void store_u64_le(uint8_t out[8], uint64_t v) {
-  OPENSSL_memcpy(out, &v, 8);
-}
-
 typedef __m128i xmmi;
 
 static const alignas(16) uint32_t poly1305_x64_sse2_message_mask[4] = {
@@ -92,9 +78,10 @@ typedef struct poly1305_state_internal_t {
 } poly1305_state_internal; /* 448 bytes total + 63 bytes for
                               alignment = 511 bytes raw */
 
-OPENSSL_STATIC_ASSERT(
-    sizeof(struct poly1305_state_internal_t) + 63 <= sizeof(poly1305_state),
-    "poly1305_state isn't large enough to hold aligned poly1305_state_internal_t");
+static_assert(sizeof(struct poly1305_state_internal_t) + 63 <=
+                  sizeof(poly1305_state),
+              "poly1305_state isn't large enough to hold aligned "
+              "poly1305_state_internal_t");
 
 static inline poly1305_state_internal *poly1305_aligned_state(
     poly1305_state *state) {
@@ -112,8 +99,8 @@ void CRYPTO_poly1305_init(poly1305_state *state, const uint8_t key[32]) {
   uint64_t t0, t1;
 
   // clamp key
-  t0 = load_u64_le(key + 0);
-  t1 = load_u64_le(key + 8);
+  t0 = CRYPTO_load_u64_le(key + 0);
+  t1 = CRYPTO_load_u64_le(key + 8);
   r0 = t0 & 0xffc0fffffff;
   t0 >>= 44;
   t0 |= t1 << 20;
@@ -131,10 +118,10 @@ void CRYPTO_poly1305_init(poly1305_state *state, const uint8_t key[32]) {
   p->R22.d[3] = (uint32_t)(r2 >> 32);
 
   // store pad
-  p->R23.d[1] = load_u32_le(key + 16);
-  p->R23.d[3] = load_u32_le(key + 20);
-  p->R24.d[1] = load_u32_le(key + 24);
-  p->R24.d[3] = load_u32_le(key + 28);
+  p->R23.d[1] = CRYPTO_load_u32_le(key + 16);
+  p->R23.d[3] = CRYPTO_load_u32_le(key + 20);
+  p->R24.d[1] = CRYPTO_load_u32_le(key + 24);
+  p->R24.d[3] = CRYPTO_load_u32_le(key + 28);
 
   // H = 0
   st->H[0] = _mm_setzero_si128();
@@ -766,8 +753,8 @@ void CRYPTO_poly1305_finish(poly1305_state *state, uint8_t mac[16]) {
   }
 
 poly1305_donna_atleast16bytes:
-  t0 = load_u64_le(m + 0);
-  t1 = load_u64_le(m + 8);
+  t0 = CRYPTO_load_u64_le(m + 0);
+  t1 = CRYPTO_load_u64_le(m + 8);
   h0 += t0 & 0xfffffffffff;
   t0 = shr128_pair(t1, t0, 44);
   h1 += t0 & 0xfffffffffff;
@@ -806,8 +793,8 @@ poly1305_donna_atmost15bytes:
   OPENSSL_memset(m + leftover, 0, 16 - leftover);
   leftover = 16;
 
-  t0 = load_u64_le(m + 0);
-  t1 = load_u64_le(m + 8);
+  t0 = CRYPTO_load_u64_le(m + 0);
+  t1 = CRYPTO_load_u64_le(m + 8);
   h0 += t0 & 0xfffffffffff;
   t0 = shr128_pair(t1, t0, 44);
   h1 += t0 & 0xfffffffffff;
@@ -853,8 +840,8 @@ poly1305_donna_finish:
   t1 = (t1 >> 24);
   h2 += (t1)+c;
 
-  store_u64_le(mac + 0, ((h0) | (h1 << 44)));
-  store_u64_le(mac + 8, ((h1 >> 20) | (h2 << 24)));
+  CRYPTO_store_u64_le(mac + 0, ((h0) | (h1 << 44)));
+  CRYPTO_store_u64_le(mac + 8, ((h1 >> 20) | (h2 << 24)));
 }
 
 #endif  // BORINGSSL_HAS_UINT128 && OPENSSL_X86_64

data/third_party/boringssl-with-bazel/src/crypto/pool/internal.h

@@ -18,6 +18,7 @@
 #include <openssl/lhash.h>
 #include <openssl/thread.h>
 
+#include "../internal.h"
 #include "../lhash/internal.h"
 
 
@@ -39,6 +40,7 @@ struct crypto_buffer_st {
 struct crypto_buffer_pool_st {
   LHASH_OF(CRYPTO_BUFFER) *bufs;
   CRYPTO_MUTEX lock;
+  const uint64_t hash_key[2];
 };
 
 

data/third_party/boringssl-with-bazel/src/crypto/pool/pool.c

@@ -19,6 +19,8 @@
 
 #include <openssl/bytestring.h>
 #include <openssl/mem.h>
+#include <openssl/rand.h>
+#include <openssl/siphash.h>
 #include <openssl/thread.h>
 
 #include "../internal.h"
@@ -26,10 +28,13 @@
 
 
 static uint32_t CRYPTO_BUFFER_hash(const CRYPTO_BUFFER *buf) {
-  return OPENSSL_hash32(buf->data, buf->len);
+  return (uint32_t)SIPHASH_24(buf->pool->hash_key, buf->data, buf->len);
 }
 
 static int CRYPTO_BUFFER_cmp(const CRYPTO_BUFFER *a, const CRYPTO_BUFFER *b) {
+  // Only |CRYPTO_BUFFER|s from the same pool have compatible hashes.
+  assert(a->pool != NULL);
+  assert(a->pool == b->pool);
   if (a->len != b->len) {
     return 1;
   }
@@ -50,6 +55,7 @@ CRYPTO_BUFFER_POOL* CRYPTO_BUFFER_POOL_new(void) {
   }
 
   CRYPTO_MUTEX_init(&pool->lock);
+  RAND_bytes((uint8_t *)&pool->hash_key, sizeof(pool->hash_key));
 
   return pool;
 }
@@ -84,6 +90,7 @@ static CRYPTO_BUFFER *crypto_buffer_new(const uint8_t *data, size_t len,
     CRYPTO_BUFFER tmp;
     tmp.data = (uint8_t *) data;
     tmp.len = len;
+    tmp.pool = pool;
 
     CRYPTO_MUTEX_lock_read(&pool->lock);
     CRYPTO_BUFFER *duplicate = lh_CRYPTO_BUFFER_retrieve(pool->bufs, &tmp);