grpc 1.54.3 → 1.59.2

data/third_party/boringssl-with-bazel/src/crypto/mem.c

@@ -159,21 +159,20 @@ static const uint8_t kBoringSSLBinaryTag[18] = {
 };
 
 #if defined(BORINGSSL_MALLOC_FAILURE_TESTING)
-static struct CRYPTO_STATIC_MUTEX malloc_failure_lock =
-    CRYPTO_STATIC_MUTEX_INIT;
+static CRYPTO_MUTEX malloc_failure_lock = CRYPTO_MUTEX_INIT;
 static uint64_t current_malloc_count = 0;
 static uint64_t malloc_number_to_fail = 0;
 static int malloc_failure_enabled = 0, break_on_malloc_fail = 0,
            any_malloc_failed = 0;
 
 static void malloc_exit_handler(void) {
-  CRYPTO_STATIC_MUTEX_lock_read(&malloc_failure_lock);
+  CRYPTO_MUTEX_lock_read(&malloc_failure_lock);
   if (any_malloc_failed) {
     // Signal to the test driver that some allocation failed, so it knows to
     // increment the counter and continue.
     _exit(88);
   }
-  CRYPTO_STATIC_MUTEX_unlock_read(&malloc_failure_lock);
+  CRYPTO_MUTEX_unlock_read(&malloc_failure_lock);
 }
 
 static void init_malloc_failure(void) {
@@ -200,11 +199,11 @@ static int should_fail_allocation() {
 
   // We lock just so multi-threaded tests are still correct, but we won't test
   // every malloc exhaustively.
-  CRYPTO_STATIC_MUTEX_lock_write(&malloc_failure_lock);
+  CRYPTO_MUTEX_lock_write(&malloc_failure_lock);
   int should_fail = current_malloc_count == malloc_number_to_fail;
   current_malloc_count++;
   any_malloc_failed = any_malloc_failed || should_fail;
-  CRYPTO_STATIC_MUTEX_unlock_write(&malloc_failure_lock);
+  CRYPTO_MUTEX_unlock_write(&malloc_failure_lock);
 
   if (should_fail && break_on_malloc_fail) {
     raise(SIGTRAP);
@@ -216,9 +215,9 @@ static int should_fail_allocation() {
 }
 
 void OPENSSL_reset_malloc_counter_for_testing(void) {
-  CRYPTO_STATIC_MUTEX_lock_write(&malloc_failure_lock);
+  CRYPTO_MUTEX_lock_write(&malloc_failure_lock);
   current_malloc_count = 0;
-  CRYPTO_STATIC_MUTEX_unlock_write(&malloc_failure_lock);
+  CRYPTO_MUTEX_unlock_write(&malloc_failure_lock);
 }
 
 #else

data/third_party/boringssl-with-bazel/src/crypto/obj/obj.c

@@ -77,24 +77,20 @@
 
 DEFINE_LHASH_OF(ASN1_OBJECT)
 
-static struct CRYPTO_STATIC_MUTEX global_added_lock = CRYPTO_STATIC_MUTEX_INIT;
+static CRYPTO_MUTEX global_added_lock = CRYPTO_MUTEX_INIT;
 // These globals are protected by |global_added_lock|.
 static LHASH_OF(ASN1_OBJECT) *global_added_by_data = NULL;
 static LHASH_OF(ASN1_OBJECT) *global_added_by_nid = NULL;
 static LHASH_OF(ASN1_OBJECT) *global_added_by_short_name = NULL;
 static LHASH_OF(ASN1_OBJECT) *global_added_by_long_name = NULL;
 
-static struct CRYPTO_STATIC_MUTEX global_next_nid_lock =
-    CRYPTO_STATIC_MUTEX_INIT;
+static CRYPTO_MUTEX global_next_nid_lock = CRYPTO_MUTEX_INIT;
 static unsigned global_next_nid = NUM_NID;
 
 static int obj_next_nid(void) {
-  int ret;
-
-  CRYPTO_STATIC_MUTEX_lock_write(&global_next_nid_lock);
-  ret = global_next_nid++;
-  CRYPTO_STATIC_MUTEX_unlock_write(&global_next_nid_lock);
-
+  CRYPTO_MUTEX_lock_write(&global_next_nid_lock);
+  int ret = global_next_nid++;
+  CRYPTO_MUTEX_unlock_write(&global_next_nid_lock);
   return ret;
 }
 
@@ -163,11 +159,10 @@ err:
 }
 
 int OBJ_cmp(const ASN1_OBJECT *a, const ASN1_OBJECT *b) {
-  int ret;
-
-  ret = a->length - b->length;
-  if (ret) {
-    return ret;
+  if (a->length < b->length) {
+    return -1;
+  } else if (a->length > b->length) {
+    return 1;
   }
   return OPENSSL_memcmp(a->data, b->data, a->length);
 }
@@ -193,15 +188,7 @@ size_t OBJ_length(const ASN1_OBJECT *obj) {
 // unsigned int in the array.
 static int obj_cmp(const void *key, const void *element) {
   uint16_t nid = *((const uint16_t *)element);
-  const ASN1_OBJECT *a = key;
-  const ASN1_OBJECT *b = &kObjects[nid];
-
-  if (a->length < b->length) {
-    return -1;
-  } else if (a->length > b->length) {
-    return 1;
-  }
-  return OPENSSL_memcmp(a->data, b->data, a->length);
+  return OBJ_cmp(key, &kObjects[nid]);
 }
 
 int OBJ_obj2nid(const ASN1_OBJECT *obj) {
@@ -213,17 +200,17 @@ int OBJ_obj2nid(const ASN1_OBJECT *obj) {
     return obj->nid;
   }
 
-  CRYPTO_STATIC_MUTEX_lock_read(&global_added_lock);
+  CRYPTO_MUTEX_lock_read(&global_added_lock);
   if (global_added_by_data != NULL) {
     ASN1_OBJECT *match;
 
     match = lh_ASN1_OBJECT_retrieve(global_added_by_data, obj);
     if (match != NULL) {
-      CRYPTO_STATIC_MUTEX_unlock_read(&global_added_lock);
+      CRYPTO_MUTEX_unlock_read(&global_added_lock);
       return match->nid;
     }
   }
-  CRYPTO_STATIC_MUTEX_unlock_read(&global_added_lock);
+  CRYPTO_MUTEX_unlock_read(&global_added_lock);
 
   const uint16_t *nid_ptr =
       bsearch(obj, kNIDsInOIDOrder, OPENSSL_ARRAY_SIZE(kNIDsInOIDOrder),
@@ -259,18 +246,18 @@ static int short_name_cmp(const void *key, const void *element) {
 }
 
 int OBJ_sn2nid(const char *short_name) {
-  CRYPTO_STATIC_MUTEX_lock_read(&global_added_lock);
+  CRYPTO_MUTEX_lock_read(&global_added_lock);
   if (global_added_by_short_name != NULL) {
     ASN1_OBJECT *match, template;
 
     template.sn = short_name;
     match = lh_ASN1_OBJECT_retrieve(global_added_by_short_name, &template);
     if (match != NULL) {
-      CRYPTO_STATIC_MUTEX_unlock_read(&global_added_lock);
+      CRYPTO_MUTEX_unlock_read(&global_added_lock);
       return match->nid;
     }
   }
-  CRYPTO_STATIC_MUTEX_unlock_read(&global_added_lock);
+  CRYPTO_MUTEX_unlock_read(&global_added_lock);
 
   const uint16_t *nid_ptr =
       bsearch(short_name, kNIDsInShortNameOrder,
@@ -294,18 +281,18 @@ static int long_name_cmp(const void *key, const void *element) {
 }
 
 int OBJ_ln2nid(const char *long_name) {
-  CRYPTO_STATIC_MUTEX_lock_read(&global_added_lock);
+  CRYPTO_MUTEX_lock_read(&global_added_lock);
   if (global_added_by_long_name != NULL) {
     ASN1_OBJECT *match, template;
 
     template.ln = long_name;
     match = lh_ASN1_OBJECT_retrieve(global_added_by_long_name, &template);
     if (match != NULL) {
-      CRYPTO_STATIC_MUTEX_unlock_read(&global_added_lock);
+      CRYPTO_MUTEX_unlock_read(&global_added_lock);
       return match->nid;
     }
   }
-  CRYPTO_STATIC_MUTEX_unlock_read(&global_added_lock);
+  CRYPTO_MUTEX_unlock_read(&global_added_lock);
 
   const uint16_t *nid_ptr = bsearch(
       long_name, kNIDsInLongNameOrder, OPENSSL_ARRAY_SIZE(kNIDsInLongNameOrder),
@@ -349,18 +336,18 @@ ASN1_OBJECT *OBJ_nid2obj(int nid) {
     return (ASN1_OBJECT *)&kObjects[nid];
   }
 
-  CRYPTO_STATIC_MUTEX_lock_read(&global_added_lock);
+  CRYPTO_MUTEX_lock_read(&global_added_lock);
   if (global_added_by_nid != NULL) {
     ASN1_OBJECT *match, template;
 
     template.nid = nid;
     match = lh_ASN1_OBJECT_retrieve(global_added_by_nid, &template);
     if (match != NULL) {
-      CRYPTO_STATIC_MUTEX_unlock_read(&global_added_lock);
+      CRYPTO_MUTEX_unlock_read(&global_added_lock);
       return match;
     }
   }
-  CRYPTO_STATIC_MUTEX_unlock_read(&global_added_lock);
+  CRYPTO_MUTEX_unlock_read(&global_added_lock);
 
 err:
   OPENSSL_PUT_ERROR(OBJ, OBJ_R_UNKNOWN_NID);
@@ -478,14 +465,6 @@ static uint32_t hash_data(const ASN1_OBJECT *obj) {
   return OPENSSL_hash32(obj->data, obj->length);
 }
 
-static int cmp_data(const ASN1_OBJECT *a, const ASN1_OBJECT *b) {
-  int i = a->length - b->length;
-  if (i) {
-    return i;
-  }
-  return OPENSSL_memcmp(a->data, b->data, a->length);
-}
-
 static uint32_t hash_short_name(const ASN1_OBJECT *obj) {
   return OPENSSL_strhash(obj->sn);
 }
@@ -508,12 +487,12 @@ static int obj_add_object(ASN1_OBJECT *obj) {
   obj->flags &= ~(ASN1_OBJECT_FLAG_DYNAMIC | ASN1_OBJECT_FLAG_DYNAMIC_STRINGS |
                   ASN1_OBJECT_FLAG_DYNAMIC_DATA);
 
-  CRYPTO_STATIC_MUTEX_lock_write(&global_added_lock);
+  CRYPTO_MUTEX_lock_write(&global_added_lock);
   if (global_added_by_nid == NULL) {
     global_added_by_nid = lh_ASN1_OBJECT_new(hash_nid, cmp_nid);
   }
   if (global_added_by_data == NULL) {
-    global_added_by_data = lh_ASN1_OBJECT_new(hash_data, cmp_data);
+    global_added_by_data = lh_ASN1_OBJECT_new(hash_data, OBJ_cmp);
   }
   if (global_added_by_short_name == NULL) {
     global_added_by_short_name =
@@ -548,7 +527,7 @@ static int obj_add_object(ASN1_OBJECT *obj) {
   }
 
 err:
-  CRYPTO_STATIC_MUTEX_unlock_write(&global_added_lock);
+  CRYPTO_MUTEX_unlock_write(&global_added_lock);
   return ok;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/obj/obj_dat.h

@@ -57,7 +57,7 @@
 /* This file is generated by crypto/obj/objects.go. */
 
 
-#define NUM_NID 967
+#define NUM_NID 965
 
 static const uint8_t kObjectData[] = {
     /* NID_rsadsi */
@@ -8777,14 +8777,13 @@ static const ASN1_OBJECT kObjects[NUM_NID] = {
     {"AuthPSK", "auth-psk", NID_auth_psk, 0, NULL, 0},
     {"KxANY", "kx-any", NID_kx_any, 0, NULL, 0},
     {"AuthANY", "auth-any", NID_auth_any, 0, NULL, 0},
-    {"CECPQ2", "CECPQ2", NID_CECPQ2, 0, NULL, 0},
+    {NULL, NULL, NID_undef, 0, NULL, 0},
     {"ED448", "ED448", NID_ED448, 3, &kObjectData[6181], 0},
     {"X448", "X448", NID_X448, 3, &kObjectData[6184], 0},
     {"SHA512-256", "sha512-256", NID_sha512_256, 9, &kObjectData[6187], 0},
     {"HKDF", "hkdf", NID_hkdf, 0, NULL, 0},
-    {"X25519Kyber768", "X25519Kyber768", NID_X25519Kyber768, 0, NULL, 0},
-    {"P256Kyber768", "P256Kyber768", NID_P256Kyber768, 0, NULL, 0},
-    {"P384Kyber768", "P384Kyber768", NID_P384Kyber768, 0, NULL, 0},
+    {"X25519Kyber768Draft00", "X25519Kyber768Draft00",
+     NID_X25519Kyber768Draft00, 0, NULL, 0},
 };
 
 static const uint16_t kNIDsInShortNameOrder[] = {
@@ -8846,7 +8845,6 @@ static const uint16_t kNIDsInShortNameOrder[] = {
     110 /* CAST5-CFB */,
     109 /* CAST5-ECB */,
     111 /* CAST5-OFB */,
-    959 /* CECPQ2 */,
     894 /* CMAC */,
     13 /* CN */,
     141 /* CRLReason */,
@@ -8918,8 +8916,6 @@ static const uint16_t kNIDsInShortNameOrder[] = {
     18 /* OU */,
     749 /* Oakley-EC2N-3 */,
     750 /* Oakley-EC2N-4 */,
-    965 /* P256Kyber768 */,
-    966 /* P384Kyber768 */,
     9 /* PBE-MD2-DES */,
     168 /* PBE-MD2-RC2-64 */,
     10 /* PBE-MD5-DES */,
@@ -8986,7 +8982,7 @@ static const uint16_t kNIDsInShortNameOrder[] = {
     458 /* UID */,
     0 /* UNDEF */,
     948 /* X25519 */,
-    964 /* X25519Kyber768 */,
+    964 /* X25519Kyber768Draft00 */,
     961 /* X448 */,
     11 /* X500 */,
     378 /* X500algorithms */,
@@ -9758,7 +9754,6 @@ static const uint16_t kNIDsInLongNameOrder[] = {
     285 /* Biometric Info */,
     179 /* CA Issuers */,
     785 /* CA Repository */,
-    959 /* CECPQ2 */,
     131 /* Code Signing */,
     783 /* Diffie-Hellman based MAC */,
     382 /* Directory */,
@@ -9834,8 +9829,6 @@ static const uint16_t kNIDsInLongNameOrder[] = {
     366 /* OCSP Nonce */,
     371 /* OCSP Service Locator */,
     180 /* OCSP Signing */,
-    965 /* P256Kyber768 */,
-    966 /* P384Kyber768 */,
     161 /* PBES2 */,
     69 /* PBKDF2 */,
     162 /* PBMAC1 */,
@@ -9860,7 +9853,7 @@ static const uint16_t kNIDsInLongNameOrder[] = {
     133 /* Time Stamping */,
     375 /* Trust Root */,
     948 /* X25519 */,
-    964 /* X25519Kyber768 */,
+    964 /* X25519Kyber768Draft00 */,
     961 /* X448 */,
     12 /* X509 */,
     402 /* X509v3 AC Targeting */,

data/third_party/boringssl-with-bazel/src/crypto/pem/pem_lib.c

@@ -78,7 +78,8 @@
 static int load_iv(char **fromp, unsigned char *to, size_t num);
 static int check_pem(const char *nm, const char *name);
 
-void PEM_proc_type(char *buf, int type) {
+// PEM_proc_type appends a Proc-Type header to |buf|, determined by |type|.
+static void PEM_proc_type(char buf[PEM_BUFSIZE], int type) {
   const char *str;
 
   if (type == PEM_TYPE_ENCRYPTED) {
@@ -96,24 +97,27 @@ void PEM_proc_type(char *buf, int type) {
   OPENSSL_strlcat(buf, "\n", PEM_BUFSIZE);
 }
 
-void PEM_dek_info(char *buf, const char *type, int len, char *str) {
+// PEM_dek_info appends a DEK-Info header to |buf|, with an algorithm of |type|
+// and a single parameter, specified by hex-encoding |len| bytes from |str|.
+static void PEM_dek_info(char buf[PEM_BUFSIZE], const char *type, size_t len,
+                         char *str) {
   static const unsigned char map[17] = "0123456789ABCDEF";
-  long i;
-  int j;
 
   OPENSSL_strlcat(buf, "DEK-Info: ", PEM_BUFSIZE);
   OPENSSL_strlcat(buf, type, PEM_BUFSIZE);
   OPENSSL_strlcat(buf, ",", PEM_BUFSIZE);
-  j = strlen(buf);
-  if (j + (len * 2) + 1 > PEM_BUFSIZE) {
+  size_t buf_len = strlen(buf);
+  // We must write an additional |2 * len + 2| bytes after |buf_len|, including
+  // the trailing newline and NUL.
+  if (len > (PEM_BUFSIZE - buf_len - 2) / 2) {
     return;
   }
-  for (i = 0; i < len; i++) {
-    buf[j + i * 2] = map[(str[i] >> 4) & 0x0f];
-    buf[j + i * 2 + 1] = map[(str[i]) & 0x0f];
+  for (size_t i = 0; i < len; i++) {
+    buf[buf_len + i * 2] = map[(str[i] >> 4) & 0x0f];
+    buf[buf_len + i * 2 + 1] = map[(str[i]) & 0x0f];
   }
-  buf[j + i * 2] = '\n';
-  buf[j + i * 2 + 1] = '\0';
+  buf[buf_len + len * 2] = '\n';
+  buf[buf_len + len * 2 + 1] = '\0';
 }
 
 void *PEM_ASN1_read(d2i_of_void *d2i, const char *name, FILE *fp, void **x,
@@ -318,7 +322,7 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
       }
       kstr = (unsigned char *)buf;
     }
-    assert(iv_len <= (int)sizeof(iv));
+    assert(iv_len <= sizeof(iv));
     if (!RAND_bytes(iv, iv_len)) {  // Generate a salt
       goto err;
     }
@@ -332,7 +336,7 @@ int PEM_ASN1_write_bio(i2d_of_void *i2d, const char *name, BIO *bp, void *x,
       OPENSSL_cleanse(buf, PEM_BUFSIZE);
     }
 
-    assert(strlen(objstr) + 23 + 2 * iv_len + 13 <= sizeof buf);
+    assert(strlen(objstr) + 23 + 2 * iv_len + 13 <= sizeof(buf));
 
     buf[0] = '\0';
     PEM_proc_type(buf, PEM_TYPE_ENCRYPTED);
@@ -781,5 +785,5 @@ int PEM_def_callback(char *buf, int size, int rwflag, void *userdata) {
     return 0;
   }
   OPENSSL_strlcpy(buf, userdata, (size_t)size);
-  return len;
+  return (int)len;
 }

data/third_party/boringssl-with-bazel/src/crypto/pkcs8/internal.h

@@ -87,13 +87,13 @@ int pkcs8_pbe_decrypt(uint8_t **out, size_t *out_len, CBS *algorithm,
 // key material to |out| and returns one. Otherwise, it returns zero. |id|
 // should be one of the |PKCS12_*_ID| values.
 int pkcs12_key_gen(const char *pass, size_t pass_len, const uint8_t *salt,
-                   size_t salt_len, uint8_t id, unsigned iterations,
+                   size_t salt_len, uint8_t id, uint32_t iterations,
                    size_t out_len, uint8_t *out, const EVP_MD *md);
 
 // pkcs12_pbe_encrypt_init configures |ctx| for encrypting with a PBES1 scheme
 // defined in PKCS#12. It writes the corresponding AlgorithmIdentifier to |out|.
 int pkcs12_pbe_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx, int alg,
-                            unsigned iterations, const char *pass,
+                            uint32_t iterations, const char *pass,
                             size_t pass_len, const uint8_t *salt,
                             size_t salt_len);
 
@@ -121,7 +121,7 @@ int PKCS5_pbe2_decrypt_init(const struct pbe_suite *suite, EVP_CIPHER_CTX *ctx,
 // as defined in RFC 2998, with the specified parameters. It writes the
 // corresponding AlgorithmIdentifier to |out|.
 int PKCS5_pbe2_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx,
-                            const EVP_CIPHER *cipher, unsigned iterations,
+                            const EVP_CIPHER *cipher, uint32_t iterations,
                             const char *pass, size_t pass_len,
                             const uint8_t *salt, size_t salt_len);
 

data/third_party/boringssl-with-bazel/src/crypto/pkcs8/p5_pbev2.c

@@ -144,7 +144,7 @@ static int add_cipher_oid(CBB *out, int nid) {
 }
 
 static int pkcs5_pbe2_cipher_init(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
-                                  const EVP_MD *pbkdf2_md, unsigned iterations,
+                                  const EVP_MD *pbkdf2_md, uint32_t iterations,
                                   const char *pass, size_t pass_len,
                                   const uint8_t *salt, size_t salt_len,
                                   const uint8_t *iv, size_t iv_len, int enc) {
@@ -162,7 +162,7 @@ static int pkcs5_pbe2_cipher_init(EVP_CIPHER_CTX *ctx, const EVP_CIPHER *cipher,
 }
 
 int PKCS5_pbe2_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx,
-                            const EVP_CIPHER *cipher, unsigned iterations,
+                            const EVP_CIPHER *cipher, uint32_t iterations,
                             const char *pass, size_t pass_len,
                             const uint8_t *salt, size_t salt_len) {
   int cipher_nid = EVP_CIPHER_nid(cipher);
@@ -310,7 +310,7 @@ int PKCS5_pbe2_decrypt_init(const struct pbe_suite *suite, EVP_CIPHER_CTX *ctx,
     return 0;
   }
 
-  return pkcs5_pbe2_cipher_init(ctx, cipher, md, (unsigned)iterations, pass,
+  return pkcs5_pbe2_cipher_init(ctx, cipher, md, (uint32_t)iterations, pass,
                                 pass_len, CBS_data(&salt), CBS_len(&salt),
                                 CBS_data(&iv), CBS_len(&iv), 0 /* decrypt */);
 }

data/third_party/boringssl-with-bazel/src/crypto/pkcs8/pkcs8.c

@@ -106,7 +106,7 @@ err:
 }
 
 int pkcs12_key_gen(const char *pass, size_t pass_len, const uint8_t *salt,
-                   size_t salt_len, uint8_t id, unsigned iterations,
+                   size_t salt_len, uint8_t id, uint32_t iterations,
                    size_t out_len, uint8_t *out, const EVP_MD *md) {
   // See https://tools.ietf.org/html/rfc7292#appendix-B. Quoted parts of the
   // specification have errata applied and other typos fixed.
@@ -182,7 +182,7 @@ int pkcs12_key_gen(const char *pass, size_t pass_len, const uint8_t *salt,
         !EVP_DigestFinal_ex(&ctx, A, &A_len)) {
       goto err;
     }
-    for (unsigned iter = 1; iter < iterations; iter++) {
+    for (uint32_t iter = 1; iter < iterations; iter++) {
       if (!EVP_DigestInit_ex(&ctx, md, NULL) ||
           !EVP_DigestUpdate(&ctx, A, A_len) ||
           !EVP_DigestFinal_ex(&ctx, A, &A_len)) {
@@ -229,7 +229,7 @@ err:
 }
 
 static int pkcs12_pbe_cipher_init(const struct pbe_suite *suite,
-                                  EVP_CIPHER_CTX *ctx, unsigned iterations,
+                                  EVP_CIPHER_CTX *ctx, uint32_t iterations,
                                   const char *pass, size_t pass_len,
                                   const uint8_t *salt, size_t salt_len,
                                   int is_encrypt) {
@@ -271,7 +271,7 @@ static int pkcs12_pbe_decrypt_init(const struct pbe_suite *suite,
     return 0;
   }
 
-  return pkcs12_pbe_cipher_init(suite, ctx, (unsigned)iterations, pass,
+  return pkcs12_pbe_cipher_init(suite, ctx, (uint32_t)iterations, pass,
                                 pass_len, CBS_data(&salt), CBS_len(&salt),
                                 0 /* decrypt */);
 }
@@ -329,7 +329,7 @@ static const struct pbe_suite *get_pkcs12_pbe_suite(int pbe_nid) {
 }
 
 int pkcs12_pbe_encrypt_init(CBB *out, EVP_CIPHER_CTX *ctx, int alg,
-                            unsigned iterations, const char *pass,
+                            uint32_t iterations, const char *pass,
                             size_t pass_len, const uint8_t *salt,
                             size_t salt_len) {
   const struct pbe_suite *suite = get_pkcs12_pbe_suite(alg);
@@ -489,10 +489,10 @@ int PKCS8_marshal_encrypted_private_key(CBB *out, int pbe_nid,
   // it. See 5693a30813a031d3921a016a870420e7eb93ec90 in OpenSSL.
   int alg_ok;
   if (pbe_nid == -1) {
-    alg_ok = PKCS5_pbe2_encrypt_init(&epki, &ctx, cipher, (unsigned)iterations,
+    alg_ok = PKCS5_pbe2_encrypt_init(&epki, &ctx, cipher, (uint32_t)iterations,
                                      pass, pass_len, salt, salt_len);
   } else {
-    alg_ok = pkcs12_pbe_encrypt_init(&epki, &ctx, pbe_nid, (unsigned)iterations,
+    alg_ok = pkcs12_pbe_encrypt_init(&epki, &ctx, pbe_nid, (uint32_t)iterations,
                                      pass, pass_len, salt, salt_len);
   }
   if (!alg_ok) {

data/third_party/boringssl-with-bazel/src/crypto/pkcs8/pkcs8_x509.c

@@ -87,6 +87,7 @@ int pkcs12_iterations_acceptable(uint64_t iterations) {
   static const uint64_t kIterationsLimit = 100 * 1000000;
 #endif
 
+  assert(kIterationsLimit <= UINT32_MAX);
   return 0 < iterations && iterations <= kIterationsLimit;
 }
 
@@ -554,7 +555,7 @@ err:
 
 static int pkcs12_check_mac(int *out_mac_ok, const char *password,
                             size_t password_len, const CBS *salt,
-                            unsigned iterations, const EVP_MD *md,
+                            uint32_t iterations, const EVP_MD *md,
                             const CBS *authsafes, const CBS *expected_mac) {
   int ret = 0;
   uint8_t hmac_key[EVP_MAX_MD_SIZE];
@@ -676,13 +677,15 @@ int PKCS12_get_key_and_certs(EVP_PKEY **out_key, STACK_OF(X509) *out_certs,
     }
 
     // The iteration count is optional and the default is one.
-    uint64_t iterations = 1;
+    uint32_t iterations = 1;
     if (CBS_len(&mac_data) > 0) {
-      if (!CBS_get_asn1_uint64(&mac_data, &iterations) ||
-          !pkcs12_iterations_acceptable(iterations)) {
+      uint64_t iterations_u64;
+      if (!CBS_get_asn1_uint64(&mac_data, &iterations_u64) ||
+          !pkcs12_iterations_acceptable(iterations_u64)) {
         OPENSSL_PUT_ERROR(PKCS8, PKCS8_R_BAD_PKCS12_DATA);
         goto err;
       }
+      iterations = (uint32_t)iterations_u64;
     }
 
     int mac_ok;
@@ -1056,7 +1059,7 @@ static int add_cert_safe_contents(CBB *cbb, X509 *cert,
 }
 
 static int add_encrypted_data(CBB *out, int pbe_nid, const char *password,
-                              size_t password_len, unsigned iterations,
+                              size_t password_len, uint32_t iterations,
                               const uint8_t *in, size_t in_len) {
   uint8_t salt[PKCS5_SALT_LEN];
   if (!RAND_bytes(salt, sizeof(salt))) {

data/third_party/boringssl-with-bazel/src/crypto/pool/internal.h

@@ -18,6 +18,7 @@
 #include <openssl/lhash.h>
 #include <openssl/thread.h>
 
+#include "../internal.h"
 #include "../lhash/internal.h"
 
 

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/deterministic.c

@@ -14,14 +14,15 @@
 
 #include <openssl/rand.h>
 
-#if defined(BORINGSSL_UNSAFE_DETERMINISTIC_MODE)
+#include "../fipsmodule/rand/internal.h"
+
+#if defined(OPENSSL_RAND_DETERMINISTIC)
 
 #include <string.h>
 
 #include <openssl/chacha.h>
 
 #include "../internal.h"
-#include "../fipsmodule/rand/internal.h"
 
 
 // g_num_calls is the number of calls to |CRYPTO_sysrand| that have occurred.
@@ -30,16 +31,16 @@
 // multi-threaded program, replace this with a thread-local. (A mutex would not
 // be deterministic.)
 static uint64_t g_num_calls = 0;
-static struct CRYPTO_STATIC_MUTEX g_num_calls_lock = CRYPTO_STATIC_MUTEX_INIT;
+static CRYPTO_MUTEX g_num_calls_lock = CRYPTO_MUTEX_INIT;
 
 void RAND_reset_for_fuzzing(void) { g_num_calls = 0; }
 
 void CRYPTO_sysrand(uint8_t *out, size_t requested) {
   static const uint8_t kZeroKey[32];
 
-  CRYPTO_STATIC_MUTEX_lock_write(&g_num_calls_lock);
+  CRYPTO_MUTEX_lock_write(&g_num_calls_lock);
   uint64_t num_calls = g_num_calls++;
-  CRYPTO_STATIC_MUTEX_unlock_write(&g_num_calls_lock);
+  CRYPTO_MUTEX_unlock_write(&g_num_calls_lock);
 
   uint8_t nonce[12];
   OPENSSL_memset(nonce, 0, sizeof(nonce));
@@ -53,4 +54,4 @@ void CRYPTO_sysrand_for_seed(uint8_t *out, size_t requested) {
   CRYPTO_sysrand(out, requested);
 }
 
-#endif  // BORINGSSL_UNSAFE_DETERMINISTIC_MODE
+#endif  // OPENSSL_RAND_DETERMINISTIC

data/third_party/boringssl-with-bazel/src/crypto/rand_extra/forkunsafe.c

@@ -17,13 +17,12 @@
 #include <stdlib.h>
 
 #include "../fipsmodule/rand/internal.h"
+#include "../internal.h"
 
 
-// g_buffering_enabled is true if fork-unsafe buffering has been enabled.
-static int g_buffering_enabled = 0;
-
-// g_lock protects |g_buffering_enabled|.
-static struct CRYPTO_STATIC_MUTEX g_lock = CRYPTO_STATIC_MUTEX_INIT;
+// g_buffering_enabled is one if fork-unsafe buffering has been enabled and zero
+// otherwise.
+static CRYPTO_atomic_u32 g_buffering_enabled = 0;
 
 #if !defined(OPENSSL_WINDOWS)
 void RAND_enable_fork_unsafe_buffering(int fd) {
@@ -32,15 +31,10 @@ void RAND_enable_fork_unsafe_buffering(int fd) {
     abort();
   }
 
-  CRYPTO_STATIC_MUTEX_lock_write(&g_lock);
-  g_buffering_enabled = 1;
-  CRYPTO_STATIC_MUTEX_unlock_write(&g_lock);
+  CRYPTO_atomic_store_u32(&g_buffering_enabled, 1);
 }
 #endif
 
 int rand_fork_unsafe_buffering_enabled(void) {
-  CRYPTO_STATIC_MUTEX_lock_read(&g_lock);
-  const int ret = g_buffering_enabled;
-  CRYPTO_STATIC_MUTEX_unlock_read(&g_lock);
-  return ret;
+  return CRYPTO_atomic_load_u32(&g_buffering_enabled) != 0;
 }