grpc 1.54.3 → 1.59.2

data/third_party/boringssl-with-bazel/src/crypto/ec_extra/internal.h

@@ -26,23 +26,29 @@ extern "C" {
 
 // Hash-to-curve.
 //
-// Internal |EC_RAW_POINT| versions of the corresponding public APIs.
+// Internal |EC_JACOBIAN| versions of the corresponding public APIs.
 
 // ec_hash_to_curve_p256_xmd_sha256_sswu hashes |msg| to a point on |group| and
 // writes the result to |out|, implementing the P256_XMD:SHA-256_SSWU_RO_ suite
-// from draft-irtf-cfrg-hash-to-curve-16. It returns one on success and zero on
-// error.
+// from RFC 9380. It returns one on success and zero on error.
 OPENSSL_EXPORT int ec_hash_to_curve_p256_xmd_sha256_sswu(
-    const EC_GROUP *group, EC_RAW_POINT *out, const uint8_t *dst,
-    size_t dst_len, const uint8_t *msg, size_t msg_len);
+    const EC_GROUP *group, EC_JACOBIAN *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len);
 
 // ec_hash_to_curve_p384_xmd_sha384_sswu hashes |msg| to a point on |group| and
 // writes the result to |out|, implementing the P384_XMD:SHA-384_SSWU_RO_ suite
-// from draft-irtf-cfrg-hash-to-curve-16. It returns one on success and zero on
-// error.
+// from RFC 9380. It returns one on success and zero on error.
 OPENSSL_EXPORT int ec_hash_to_curve_p384_xmd_sha384_sswu(
-    const EC_GROUP *group, EC_RAW_POINT *out, const uint8_t *dst,
-    size_t dst_len, const uint8_t *msg, size_t msg_len);
+    const EC_GROUP *group, EC_JACOBIAN *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len);
+
+// ec_hash_to_scalar_p384_xmd_sha384 hashes |msg| to a scalar on |group|
+// and writes the result to |out|, using the hash_to_field operation from the
+// P384_XMD:SHA-384_SSWU_RO_ suite from RFC 9380, but generating a value modulo
+// the group order rather than a field element.
+OPENSSL_EXPORT int ec_hash_to_scalar_p384_xmd_sha384(
+    const EC_GROUP *group, EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len);
 
 // ec_hash_to_curve_p384_xmd_sha512_sswu_draft07 hashes |msg| to a point on
 // |group| and writes the result to |out|, implementing the
@@ -51,8 +57,8 @@ OPENSSL_EXPORT int ec_hash_to_curve_p384_xmd_sha384_sswu(
 //
 // TODO(https://crbug.com/1414562): Migrate this to the final version.
 OPENSSL_EXPORT int ec_hash_to_curve_p384_xmd_sha512_sswu_draft07(
-    const EC_GROUP *group, EC_RAW_POINT *out, const uint8_t *dst,
-    size_t dst_len, const uint8_t *msg, size_t msg_len);
+    const EC_GROUP *group, EC_JACOBIAN *out, const uint8_t *dst, size_t dst_len,
+    const uint8_t *msg, size_t msg_len);
 
 // ec_hash_to_scalar_p384_xmd_sha512_draft07 hashes |msg| to a scalar on |group|
 // and writes the result to |out|, using the hash_to_field operation from the

data/third_party/boringssl-with-bazel/src/crypto/ecdh_extra/ecdh_extra.c

@@ -92,7 +92,7 @@ int ECDH_compute_key(void *out, size_t out_len, const EC_POINT *pub_key,
     return -1;
   }
 
-  EC_RAW_POINT shared_point;
+  EC_JACOBIAN shared_point;
   uint8_t buf[EC_MAX_BYTES];
   size_t buf_len;
   if (!ec_point_mul_scalar(group, &shared_point, &pub_key->raw, priv) ||

data/third_party/boringssl-with-bazel/src/crypto/err/err.c

@@ -146,13 +146,13 @@ struct err_error_st {
 
 // ERR_STATE contains the per-thread, error queue.
 typedef struct err_state_st {
-  // errors contains the ERR_NUM_ERRORS most recent errors, organised as a ring
-  // buffer.
+  // errors contains up to ERR_NUM_ERRORS - 1 most recent errors, organised as a
+  // ring buffer.
   struct err_error_st errors[ERR_NUM_ERRORS];
-  // top contains the index one past the most recent error. If |top| equals
-  // |bottom| then the queue is empty.
+  // top contains the index of the most recent error. If |top| equals |bottom|
+  // then the queue is empty.
   unsigned top;
-  // bottom contains the index of the last error in the queue.
+  // bottom contains the index before the least recent error in the queue.
   unsigned bottom;
 
   // to_free, if not NULL, contains a pointer owned by this structure that was
@@ -192,8 +192,7 @@ static int global_next_library = ERR_NUM_LIBS;
 
 // global_next_library_mutex protects |global_next_library| from concurrent
 // updates.
-static struct CRYPTO_STATIC_MUTEX global_next_library_mutex =
-    CRYPTO_STATIC_MUTEX_INIT;
+static CRYPTO_MUTEX global_next_library_mutex = CRYPTO_MUTEX_INIT;
 
 static void err_state_free(void *statep) {
   ERR_STATE *state = statep;
@@ -367,9 +366,9 @@ void ERR_remove_thread_state(const CRYPTO_THREADID *tid) {
 int ERR_get_next_error_library(void) {
   int ret;
 
-  CRYPTO_STATIC_MUTEX_lock_write(&global_next_library_mutex);
+  CRYPTO_MUTEX_lock_write(&global_next_library_mutex);
   ret = global_next_library++;
-  CRYPTO_STATIC_MUTEX_unlock_write(&global_next_library_mutex);
+  CRYPTO_MUTEX_unlock_write(&global_next_library_mutex);
 
   return ret;
 }
@@ -553,22 +552,21 @@ char *ERR_error_string_n(uint32_t packed_error, char *buf, size_t len) {
   const char *lib_str = err_lib_error_string(packed_error);
   const char *reason_str = err_reason_error_string(packed_error);
 
-  char lib_buf[64], reason_buf[64];
+  char lib_buf[32], reason_buf[32];
   if (lib_str == NULL) {
-    BIO_snprintf(lib_buf, sizeof(lib_buf), "lib(%u)", lib);
+    snprintf(lib_buf, sizeof(lib_buf), "lib(%u)", lib);
     lib_str = lib_buf;
   }
 
- if (reason_str == NULL) {
-    BIO_snprintf(reason_buf, sizeof(reason_buf), "reason(%u)", reason);
+  if (reason_str == NULL) {
+    snprintf(reason_buf, sizeof(reason_buf), "reason(%u)", reason);
     reason_str = reason_buf;
   }
 
-  BIO_snprintf(buf, len, "error:%08" PRIx32 ":%s:OPENSSL_internal:%s",
-               packed_error, lib_str, reason_str);
-
-  if (strlen(buf) == len - 1) {
-    // output may be truncated; make sure we always have 5 colon-separated
+  int ret = snprintf(buf, len, "error:%08" PRIx32 ":%s:OPENSSL_internal:%s",
+                     packed_error, lib_str, reason_str);
+  if (ret >= 0 && (size_t)ret >= len) {
+    // The output was truncated; make sure we always have 5 colon-separated
     // fields, i.e. 4 colons.
     static const unsigned num_colons = 4;
     unsigned i;
@@ -618,8 +616,8 @@ void ERR_print_errors_cb(ERR_print_errors_callback_t callback, void *ctx) {
     }
 
     ERR_error_string_n(packed_error, buf, sizeof(buf));
-    BIO_snprintf(buf2, sizeof(buf2), "%lu:%s:%s:%d:%s\n", thread_hash, buf,
-                 file, line, (flags & ERR_FLAG_STRING) ? data : "");
+    snprintf(buf2, sizeof(buf2), "%lu:%s:%s:%d:%s\n", thread_hash, buf, file,
+             line, (flags & ERR_FLAG_STRING) ? data : "");
     if (callback(buf2, strlen(buf2), ctx) <= 0) {
       break;
     }
@@ -867,6 +865,10 @@ void ERR_restore_state(const ERR_SAVE_STATE *state) {
     return;
   }
 
+  if (state->num_errors >= ERR_NUM_ERRORS) {
+    abort();
+  }
+
   ERR_STATE *const dst = err_get_state();
   if (dst == NULL) {
     return;
@@ -875,6 +877,6 @@ void ERR_restore_state(const ERR_SAVE_STATE *state) {
   for (size_t i = 0; i < state->num_errors; i++) {
     err_copy(&dst->errors[i], &state->errors[i]);
   }
-  dst->top = state->num_errors - 1;
+  dst->top = (unsigned)(state->num_errors - 1);
   dst->bottom = ERR_NUM_ERRORS - 1;
 }

data/third_party/boringssl-with-bazel/src/crypto/evp/evp.c

@@ -229,6 +229,13 @@ static const EVP_PKEY_ASN1_METHOD *evp_pkey_asn1_find(int nid) {
   }
 }
 
+static void evp_pkey_set_method(EVP_PKEY *pkey,
+                                const EVP_PKEY_ASN1_METHOD *method) {
+  free_it(pkey);
+  pkey->ameth = method;
+  pkey->type = pkey->ameth->pkey_id;
+}
+
 int EVP_PKEY_type(int nid) {
   const EVP_PKEY_ASN1_METHOD *meth = evp_pkey_asn1_find(nid);
   if (meth == NULL) {
@@ -246,7 +253,9 @@ int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key) {
 }
 
 int EVP_PKEY_assign_RSA(EVP_PKEY *pkey, RSA *key) {
-  return EVP_PKEY_assign(pkey, EVP_PKEY_RSA, key);
+  evp_pkey_set_method(pkey, &rsa_asn1_meth);
+  pkey->pkey = key;
+  return key != NULL;
 }
 
 RSA *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey) {
@@ -274,7 +283,9 @@ int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key) {
 }
 
 int EVP_PKEY_assign_DSA(EVP_PKEY *pkey, DSA *key) {
-  return EVP_PKEY_assign(pkey, EVP_PKEY_DSA, key);
+  evp_pkey_set_method(pkey, &dsa_asn1_meth);
+  pkey->pkey = key;
+  return key != NULL;
 }
 
 DSA *EVP_PKEY_get0_DSA(const EVP_PKEY *pkey) {
@@ -302,7 +313,9 @@ int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) {
 }
 
 int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) {
-  return EVP_PKEY_assign(pkey, EVP_PKEY_EC, key);
+  evp_pkey_set_method(pkey, &ec_asn1_meth);
+  pkey->pkey = key;
+  return key != NULL;
 }
 
 EC_KEY *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey) {
@@ -325,21 +338,32 @@ DH *EVP_PKEY_get0_DH(const EVP_PKEY *pkey) { return NULL; }
 DH *EVP_PKEY_get1_DH(const EVP_PKEY *pkey) { return NULL; }
 
 int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key) {
-  if (!EVP_PKEY_set_type(pkey, type)) {
-    return 0;
+  // This function can only be used to assign RSA, DSA, and EC keys. Other key
+  // types have internal representations which are not exposed through the
+  // public API.
+  switch (type) {
+    case EVP_PKEY_RSA:
+      return EVP_PKEY_assign_RSA(pkey, key);
+    case EVP_PKEY_DSA:
+      return EVP_PKEY_assign_DSA(pkey, key);
+    case EVP_PKEY_EC:
+      return EVP_PKEY_assign_EC_KEY(pkey, key);
   }
-  pkey->pkey = key;
-  return key != NULL;
+
+  OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
+  ERR_add_error_dataf("algorithm %d", type);
+  return 0;
 }
 
 int EVP_PKEY_set_type(EVP_PKEY *pkey, int type) {
-  const EVP_PKEY_ASN1_METHOD *ameth;
-
   if (pkey && pkey->pkey) {
+    // This isn't strictly necessary, but historically |EVP_PKEY_set_type| would
+    // clear |pkey| even if |evp_pkey_asn1_find| failed, so we preserve that
+    // behavior.
     free_it(pkey);
   }
 
-  ameth = evp_pkey_asn1_find(type);
+  const EVP_PKEY_ASN1_METHOD *ameth = evp_pkey_asn1_find(type);
   if (ameth == NULL) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
     ERR_add_error_dataf("algorithm %d", type);
@@ -347,8 +371,7 @@ int EVP_PKEY_set_type(EVP_PKEY *pkey, int type) {
   }
 
   if (pkey) {
-    pkey->ameth = ameth;
-    pkey->type = pkey->ameth->pkey_id;
+    evp_pkey_set_method(pkey, ameth);
   }
 
   return 1;

data/third_party/boringssl-with-bazel/src/crypto/evp/p_ec.c

@@ -75,7 +75,7 @@
 typedef struct {
   // message digest
   const EVP_MD *md;
-  EC_GROUP *gen_group;
+  const EC_GROUP *gen_group;
 } EC_PKEY_CTX;
 
 
@@ -111,7 +111,6 @@ static void pkey_ec_cleanup(EVP_PKEY_CTX *ctx) {
     return;
   }
 
-  EC_GROUP_free(dctx->gen_group);
   OPENSSL_free(dctx);
 }
 
@@ -195,11 +194,10 @@ static int pkey_ec_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) {
       return 1;
 
     case EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID: {
-      EC_GROUP *group = EC_GROUP_new_by_curve_name(p1);
+      const EC_GROUP *group = EC_GROUP_new_by_curve_name(p1);
       if (group == NULL) {
         return 0;
       }
-      EC_GROUP_free(dctx->gen_group);
       dctx->gen_group = group;
       return 1;
     }

data/third_party/boringssl-with-bazel/src/crypto/evp/p_ec_asn1.c

@@ -94,7 +94,7 @@ static int eckey_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) {
 
   // The parameters are a named curve.
   EC_KEY *eckey = NULL;
-  EC_GROUP *group = EC_KEY_parse_curve_name(params);
+  const EC_GROUP *group = EC_KEY_parse_curve_name(params);
   if (group == NULL || CBS_len(params) != 0) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
     goto err;
@@ -107,12 +107,10 @@ static int eckey_pub_decode(EVP_PKEY *out, CBS *params, CBS *key) {
     goto err;
   }
 
-  EC_GROUP_free(group);
   EVP_PKEY_assign_EC_KEY(out, eckey);
   return 1;
 
 err:
-  EC_GROUP_free(group);
   EC_KEY_free(eckey);
   return 0;
 }
@@ -135,15 +133,13 @@ static int eckey_pub_cmp(const EVP_PKEY *a, const EVP_PKEY *b) {
 
 static int eckey_priv_decode(EVP_PKEY *out, CBS *params, CBS *key) {
   // See RFC 5915.
-  EC_GROUP *group = EC_KEY_parse_parameters(params);
+  const EC_GROUP *group = EC_KEY_parse_parameters(params);
   if (group == NULL || CBS_len(params) != 0) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
-    EC_GROUP_free(group);
     return 0;
   }
 
   EC_KEY *ec_key = EC_KEY_parse_private_key(key, group);
-  EC_GROUP_free(group);
   if (ec_key == NULL || CBS_len(key) != 0) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_DECODE_ERROR);
     EC_KEY_free(ec_key);
@@ -215,7 +211,7 @@ static int ec_bits(const EVP_PKEY *pkey) {
     ERR_clear_error();
     return 0;
   }
-  return BN_num_bits(EC_GROUP_get0_order(group));
+  return EC_GROUP_order_bits(group);
 }
 
 static int ec_missing_parameters(const EVP_PKEY *pkey) {

data/third_party/boringssl-with-bazel/src/crypto/evp/p_rsa.c

@@ -67,7 +67,7 @@
 #include <openssl/rsa.h>
 
 #include "../internal.h"
-#include "../fipsmodule/rsa/internal.h"
+#include "../rsa_extra/internal.h"
 #include "internal.h"
 
 

data/third_party/boringssl-with-bazel/src/crypto/evp/pbkdf.c

@@ -63,7 +63,7 @@
 
 
 int PKCS5_PBKDF2_HMAC(const char *password, size_t password_len,
-                      const uint8_t *salt, size_t salt_len, unsigned iterations,
+                      const uint8_t *salt, size_t salt_len, uint32_t iterations,
                       const EVP_MD *digest, size_t key_len, uint8_t *out_key) {
   // See RFC 8018, section 5.2.
   int ret = 0;
@@ -98,7 +98,7 @@ int PKCS5_PBKDF2_HMAC(const char *password, size_t password_len,
     }
 
     OPENSSL_memcpy(out_key, digest_tmp, todo);
-    for (unsigned j = 1; j < iterations; j++) {
+    for (uint32_t j = 1; j < iterations; j++) {
       // Compute the remaining U_* values and XOR.
       if (!HMAC_Init_ex(&hctx, NULL, 0, NULL, NULL) ||
           !HMAC_Update(&hctx, digest_tmp, md_len) ||
@@ -139,7 +139,7 @@ err:
 
 int PKCS5_PBKDF2_HMAC_SHA1(const char *password, size_t password_len,
                            const uint8_t *salt, size_t salt_len,
-                           unsigned iterations, size_t key_len,
+                           uint32_t iterations, size_t key_len,
                            uint8_t *out_key) {
   return PKCS5_PBKDF2_HMAC(password, password_len, salt, salt_len, iterations,
                            EVP_sha1(), key_len, out_key);

data/third_party/boringssl-with-bazel/src/crypto/evp/print.c

@@ -194,12 +194,12 @@ static int rsa_priv_print(BIO *bp, const EVP_PKEY *pkey, int indent) {
 static int do_dsa_print(BIO *bp, const DSA *x, int off, int ptype) {
   const BIGNUM *priv_key = NULL;
   if (ptype == 2) {
-    priv_key = x->priv_key;
+    priv_key = DSA_get0_priv_key(x);
   }
 
   const BIGNUM *pub_key = NULL;
   if (ptype > 0) {
-    pub_key = x->pub_key;
+    pub_key = DSA_get0_pub_key(x);
   }
 
   const char *ktype = "DSA-Parameters";
@@ -210,14 +210,15 @@ static int do_dsa_print(BIO *bp, const DSA *x, int off, int ptype) {
   }
 
   if (!BIO_indent(bp, off, 128) ||
-      BIO_printf(bp, "%s: (%u bit)\n", ktype, BN_num_bits(x->p)) <= 0 ||
+      BIO_printf(bp, "%s: (%u bit)\n", ktype, BN_num_bits(DSA_get0_p(x))) <=
+          0 ||
       // |priv_key| and |pub_key| may be NULL, in which case |bn_print| will
       // silently skip them.
       !bn_print(bp, "priv:", priv_key, off) ||
       !bn_print(bp, "pub:", pub_key, off) ||
-      !bn_print(bp, "P:", x->p, off) ||
-      !bn_print(bp, "Q:", x->q, off) ||
-      !bn_print(bp, "G:", x->g, off)) {
+      !bn_print(bp, "P:", DSA_get0_p(x), off) ||
+      !bn_print(bp, "Q:", DSA_get0_q(x), off) ||
+      !bn_print(bp, "G:", DSA_get0_g(x), off)) {
     return 0;
   }
 

data/third_party/boringssl-with-bazel/src/crypto/ex_data.c

@@ -116,7 +116,6 @@
 #include <openssl/crypto.h>
 #include <openssl/err.h>
 #include <openssl/mem.h>
-#include <openssl/stack.h>
 #include <openssl/thread.h>
 
 #include "internal.h"
@@ -128,14 +127,14 @@ struct crypto_ex_data_func_st {
   long argl;   // Arbitary long
   void *argp;  // Arbitary void pointer
   CRYPTO_EX_free *free_func;
+  // next points to the next |CRYPTO_EX_DATA_FUNCS| or NULL if this is the last
+  // one. It may only be read if synchronized with a read from |num_funcs|.
+  CRYPTO_EX_DATA_FUNCS *next;
 };
 
 int CRYPTO_get_ex_new_index(CRYPTO_EX_DATA_CLASS *ex_data_class, int *out_index,
                             long argl, void *argp, CRYPTO_EX_free *free_func) {
-  CRYPTO_EX_DATA_FUNCS *funcs;
-  int ret = 0;
-
-  funcs = OPENSSL_malloc(sizeof(CRYPTO_EX_DATA_FUNCS));
+  CRYPTO_EX_DATA_FUNCS *funcs = OPENSSL_malloc(sizeof(CRYPTO_EX_DATA_FUNCS));
   if (funcs == NULL) {
     return 0;
   }
@@ -143,37 +142,32 @@ int CRYPTO_get_ex_new_index(CRYPTO_EX_DATA_CLASS *ex_data_class, int *out_index,
   funcs->argl = argl;
   funcs->argp = argp;
   funcs->free_func = free_func;
+  funcs->next = NULL;
 
-  CRYPTO_STATIC_MUTEX_lock_write(&ex_data_class->lock);
-
-  if (ex_data_class->meth == NULL) {
-    ex_data_class->meth = sk_CRYPTO_EX_DATA_FUNCS_new_null();
-  }
-
-  if (ex_data_class->meth == NULL) {
-    goto err;
-  }
+  CRYPTO_MUTEX_lock_write(&ex_data_class->lock);
 
+  uint32_t num_funcs = CRYPTO_atomic_load_u32(&ex_data_class->num_funcs);
   // The index must fit in |int|.
-  if (sk_CRYPTO_EX_DATA_FUNCS_num(ex_data_class->meth) >
-          (size_t)(INT_MAX - ex_data_class->num_reserved)) {
+  if (num_funcs > (size_t)(INT_MAX - ex_data_class->num_reserved)) {
     OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW);
-    goto err;
+    CRYPTO_MUTEX_unlock_write(&ex_data_class->lock);
+    return 0;
   }
 
-  if (!sk_CRYPTO_EX_DATA_FUNCS_push(ex_data_class->meth, funcs)) {
-    goto err;
+  // Append |funcs| to the linked list.
+  if (ex_data_class->last == NULL) {
+    assert(num_funcs == 0);
+    ex_data_class->funcs = funcs;
+    ex_data_class->last = funcs;
+  } else {
+    ex_data_class->last->next = funcs;
+    ex_data_class->last = funcs;
   }
-  funcs = NULL;  // |sk_CRYPTO_EX_DATA_FUNCS_push| takes ownership.
 
-  *out_index = (int)sk_CRYPTO_EX_DATA_FUNCS_num(ex_data_class->meth) - 1 +
-               ex_data_class->num_reserved;
-  ret = 1;
-
-err:
-  CRYPTO_STATIC_MUTEX_unlock_write(&ex_data_class->lock);
-  OPENSSL_free(funcs);
-  return ret;
+  CRYPTO_atomic_store_u32(&ex_data_class->num_funcs, num_funcs + 1);
+  CRYPTO_MUTEX_unlock_write(&ex_data_class->lock);
+  *out_index = (int)num_funcs + ex_data_class->num_reserved;
+  return 1;
 }
 
 int CRYPTO_set_ex_data(CRYPTO_EX_DATA *ad, int index, void *val) {
@@ -209,33 +203,6 @@ void *CRYPTO_get_ex_data(const CRYPTO_EX_DATA *ad, int idx) {
   return sk_void_value(ad->sk, idx);
 }
 
-// get_func_pointers takes a copy of the CRYPTO_EX_DATA_FUNCS pointers, if any,
-// for the given class. If there are some pointers, it sets |*out| to point to
-// a fresh stack of them. Otherwise it sets |*out| to NULL. It returns one on
-// success or zero on error.
-static int get_func_pointers(STACK_OF(CRYPTO_EX_DATA_FUNCS) **out,
-                             CRYPTO_EX_DATA_CLASS *ex_data_class) {
-  size_t n;
-
-  *out = NULL;
-
-  // CRYPTO_EX_DATA_FUNCS structures are static once set, so we can take a
-  // shallow copy of the list under lock and then use the structures without
-  // the lock held.
-  CRYPTO_STATIC_MUTEX_lock_read(&ex_data_class->lock);
-  n = sk_CRYPTO_EX_DATA_FUNCS_num(ex_data_class->meth);
-  if (n > 0) {
-    *out = sk_CRYPTO_EX_DATA_FUNCS_dup(ex_data_class->meth);
-  }
-  CRYPTO_STATIC_MUTEX_unlock_read(&ex_data_class->lock);
-
-  if (n > 0 && *out == NULL) {
-    return 0;
-  }
-
-  return 1;
-}
-
 void CRYPTO_new_ex_data(CRYPTO_EX_DATA *ad) {
   ad->sk = NULL;
 }
@@ -247,27 +214,22 @@ void CRYPTO_free_ex_data(CRYPTO_EX_DATA_CLASS *ex_data_class, void *obj,
     return;
   }
 
-  STACK_OF(CRYPTO_EX_DATA_FUNCS) *func_pointers;
-  if (!get_func_pointers(&func_pointers, ex_data_class)) {
-    // TODO(davidben): This leaks memory on malloc error.
-    return;
-  }
-
+  uint32_t num_funcs = CRYPTO_atomic_load_u32(&ex_data_class->num_funcs);
   // |CRYPTO_get_ex_new_index| will not allocate indices beyond |INT_MAX|.
-  assert(sk_CRYPTO_EX_DATA_FUNCS_num(func_pointers) <=
-         (size_t)(INT_MAX - ex_data_class->num_reserved));
-  for (int i = 0; i < (int)sk_CRYPTO_EX_DATA_FUNCS_num(func_pointers); i++) {
-    CRYPTO_EX_DATA_FUNCS *func_pointer =
-        sk_CRYPTO_EX_DATA_FUNCS_value(func_pointers, i);
-    if (func_pointer->free_func) {
-      void *ptr = CRYPTO_get_ex_data(ad, i + ex_data_class->num_reserved);
-      func_pointer->free_func(obj, ptr, ad, i + ex_data_class->num_reserved,
-                              func_pointer->argl, func_pointer->argp);
+  assert(num_funcs <= (size_t)(INT_MAX - ex_data_class->num_reserved));
+
+  // Defer dereferencing |ex_data_class->funcs| and |funcs->next|. It must come
+  // after the |num_funcs| comparison to be correctly synchronized.
+  CRYPTO_EX_DATA_FUNCS *const *funcs = &ex_data_class->funcs;
+  for (uint32_t i = 0; i < num_funcs; i++) {
+    if ((*funcs)->free_func != NULL) {
+      int index = (int)i + ex_data_class->num_reserved;
+      void *ptr = CRYPTO_get_ex_data(ad, index);
+      (*funcs)->free_func(obj, ptr, ad, index, (*funcs)->argl, (*funcs)->argp);
     }
+    funcs = &(*funcs)->next;
   }
 
-  sk_CRYPTO_EX_DATA_FUNCS_free(func_pointers);
-
   sk_void_free(ad->sk);
   ad->sk = NULL;
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bcm.c

@@ -80,6 +80,7 @@
 #include "ec/simple_mul.c"
 #include "ec/util.c"
 #include "ec/wnaf.c"
+#include "hkdf/hkdf.c"
 #include "hmac/hmac.c"
 #include "md4/md4.c"
 #include "md5/md5.c"
@@ -210,7 +211,7 @@ int BORINGSSL_integrity_test(void) {
 #endif
 
   assert_within(rodata_start, kPrimes, rodata_end);
-  assert_within(rodata_start, kP256Params, rodata_end);
+  assert_within(rodata_start, kP256Field, rodata_end);
   assert_within(rodata_start, kPKCS1SigPrefixes, rodata_end);
 
   uint8_t result[SHA256_DIGEST_LENGTH];

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/div.c

@@ -711,15 +711,22 @@ int BN_mod_lshift(BIGNUM *r, const BIGNUM *a, int n, const BIGNUM *m,
 
 int bn_mod_lshift_consttime(BIGNUM *r, const BIGNUM *a, int n, const BIGNUM *m,
                             BN_CTX *ctx) {
-  if (!BN_copy(r, a)) {
+  if (!BN_copy(r, a) ||
+      !bn_resize_words(r, m->width)) {
     return 0;
   }
-  for (int i = 0; i < n; i++) {
-    if (!bn_mod_lshift1_consttime(r, r, m, ctx)) {
-      return 0;
+
+  BN_CTX_start(ctx);
+  BIGNUM *tmp = bn_scratch_space_from_ctx(m->width, ctx);
+  int ok = tmp != NULL;
+  if (ok) {
+    for (int i = 0; i < n; i++) {
+      bn_mod_add_words(r->d, r->d, r->d, m->d, tmp->d, m->width);
     }
+    r->neg = 0;
   }
-  return 1;
+  BN_CTX_end(ctx);
+  return ok;
 }
 
 int BN_mod_lshift_quick(BIGNUM *r, const BIGNUM *a, int n, const BIGNUM *m) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/gcd.c

@@ -263,15 +263,14 @@ int BN_mod_inverse_odd(BIGNUM *out, int *out_no_inverse, const BIGNUM *a,
   // Now  Y*a  ==  A  (mod |n|).
 
   // Y*a == 1  (mod |n|)
-  if (!Y->neg && BN_ucmp(Y, n) < 0) {
-    if (!BN_copy(R, Y)) {
-      goto err;
-    }
-  } else {
-    if (!BN_nnmod(R, Y, n, ctx)) {
+  if (Y->neg || BN_ucmp(Y, n) >= 0) {
+    if (!BN_nnmod(Y, Y, n, ctx)) {
       goto err;
     }
   }
+  if (!BN_copy(R, Y)) {
+    goto err;
+  }
 
   ret = 1;
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/bn/internal.h

@@ -431,12 +431,11 @@ void bn_power5(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *table,
 
 uint64_t bn_mont_n0(const BIGNUM *n);
 
-// bn_mod_exp_base_2_consttime calculates r = 2**p (mod n). |p| must be larger
-// than log_2(n); i.e. 2**p must be larger than |n|. |n| must be positive and
-// odd. |p| and the bit width of |n| are assumed public, but |n| is otherwise
-// treated as secret.
-int bn_mod_exp_base_2_consttime(BIGNUM *r, unsigned p, const BIGNUM *n,
-                                BN_CTX *ctx);
+// bn_mont_ctx_set_RR_consttime initializes |mont->RR|. It returns one on
+// success and zero on error. |mont->N| and |mont->n0| must have been
+// initialized already. The bit width of |mont->N| is assumed public, but
+// |mont->N| is otherwise treated as secret.
+int bn_mont_ctx_set_RR_consttime(BN_MONT_CTX *mont, BN_CTX *ctx);
 
 #if defined(_MSC_VER)
 #if defined(OPENSSL_X86_64)
@@ -600,6 +599,13 @@ OPENSSL_EXPORT int bn_is_relatively_prime(int *out_relatively_prime,
 OPENSSL_EXPORT int bn_lcm_consttime(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
                                     BN_CTX *ctx);
 
+// bn_mont_ctx_init zero-initialies |mont|.
+void bn_mont_ctx_init(BN_MONT_CTX *mont);
+
+// bn_mont_ctx_cleanup releases memory associated with |mont|, without freeing
+// |mont| itself.
+void bn_mont_ctx_cleanup(BN_MONT_CTX *mont);
+
 
 // Constant-time modular arithmetic.
 //