grpc 1.54.3 → 1.59.2

data/third_party/boringssl-with-bazel/src/crypto/x509/x509_vfy.c

@@ -217,7 +217,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx) {
     goto end;
   }
 
-  num = sk_X509_num(ctx->chain);
+  num = (int)sk_X509_num(ctx->chain);
   x = sk_X509_value(ctx->chain, num - 1);
   depth = param->depth;
 
@@ -284,7 +284,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx) {
 
   do {
     // Examine last certificate in chain and see if it is self signed.
-    i = sk_X509_num(ctx->chain);
+    i = (int)sk_X509_num(ctx->chain);
     x = sk_X509_value(ctx->chain, i - 1);
 
     int is_self_signed;
@@ -396,7 +396,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx) {
             X509_free(xtmp);
             num--;
           }
-          ctx->last_untrusted = sk_X509_num(ctx->chain);
+          ctx->last_untrusted = (int)sk_X509_num(ctx->chain);
           retry = 1;
           break;
         }
@@ -447,7 +447,6 @@ int X509_verify_cert(X509_STORE_CTX *ctx) {
 
   // Check revocation status: we do this after copying parameters because
   // they may be needed for CRL signature verification.
-
   ok = ctx->check_revocation(ctx);
   if (!ok) {
     goto end;
@@ -464,14 +463,13 @@ int X509_verify_cert(X509_STORE_CTX *ctx) {
   }
 
   // Check name constraints
-
   ok = check_name_constraints(ctx);
   if (!ok) {
     goto end;
   }
 
-  // If we get this far evaluate policies
-  if (!bad_chain && (ctx->param->flags & X509_V_FLAG_POLICY_CHECK)) {
+  // If we get this far, evaluate policies.
+  if (!bad_chain) {
     ok = ctx->check_policy(ctx);
   }
 
@@ -630,7 +628,7 @@ static int check_name_constraints(X509_STORE_CTX *ctx) {
   int i, j, rv;
   int has_name_constraints = 0;
   // Check name constraints for all certificates
-  for (i = sk_X509_num(ctx->chain) - 1; i >= 0; i--) {
+  for (i = (int)sk_X509_num(ctx->chain) - 1; i >= 0; i--) {
     X509 *x = sk_X509_value(ctx->chain, i);
     // Ignore self issued certs unless last in chain
     if (i && (x->ex_flags & EXFLAG_SI)) {
@@ -640,7 +638,7 @@ static int check_name_constraints(X509_STORE_CTX *ctx) {
     // including trust anchor. Trust anchor not strictly speaking needed
     // but if it includes constraints it is to be assumed it expects them
     // to be obeyed.
-    for (j = sk_X509_num(ctx->chain) - 1; j > i; j--) {
+    for (j = (int)sk_X509_num(ctx->chain) - 1; j > i; j--) {
       NAME_CONSTRAINTS *nc = sk_X509_value(ctx->chain, j)->nc;
       if (nc) {
         has_name_constraints = 1;
@@ -750,11 +748,10 @@ static int check_id(X509_STORE_CTX *ctx) {
 }
 
 static int check_trust(X509_STORE_CTX *ctx) {
-  size_t i;
   int ok;
   X509 *x = NULL;
   // Check all trusted certificates in chain
-  for (i = ctx->last_untrusted; i < sk_X509_num(ctx->chain); i++) {
+  for (size_t i = ctx->last_untrusted; i < sk_X509_num(ctx->chain); i++) {
     x = sk_X509_value(ctx->chain, i);
     ok = X509_check_trust(x, ctx->param->trust, 0);
     // If explicitly trusted return trusted
@@ -764,7 +761,7 @@ static int check_trust(X509_STORE_CTX *ctx) {
     // If explicitly rejected notify callback and reject if not
     // overridden.
     if (ok == X509_TRUST_REJECTED) {
-      ctx->error_depth = i;
+      ctx->error_depth = (int)i;
       ctx->current_cert = x;
       ctx->error = X509_V_ERR_CERT_REJECTED;
       ok = ctx->verify_cb(0, ctx);
@@ -796,12 +793,12 @@ static int check_trust(X509_STORE_CTX *ctx) {
 }
 
 static int check_revocation(X509_STORE_CTX *ctx) {
-  int i, last, ok;
   if (!(ctx->param->flags & X509_V_FLAG_CRL_CHECK)) {
     return 1;
   }
+  int last;
   if (ctx->param->flags & X509_V_FLAG_CRL_CHECK_ALL) {
-    last = sk_X509_num(ctx->chain) - 1;
+    last = (int)sk_X509_num(ctx->chain) - 1;
   } else {
     // If checking CRL paths this isn't the EE certificate
     if (ctx->parent) {
@@ -809,9 +806,9 @@ static int check_revocation(X509_STORE_CTX *ctx) {
     }
     last = 0;
   }
-  for (i = 0; i <= last; i++) {
+  for (int i = 0; i <= last; i++) {
     ctx->error_depth = i;
-    ok = check_cert(ctx);
+    int ok = check_cert(ctx);
     if (!ok) {
       return ok;
     }
@@ -1480,9 +1477,9 @@ done:
 static int check_crl(X509_STORE_CTX *ctx, X509_CRL *crl) {
   X509 *issuer = NULL;
   EVP_PKEY *ikey = NULL;
-  int ok = 0, chnum, cnum;
-  cnum = ctx->error_depth;
-  chnum = sk_X509_num(ctx->chain) - 1;
+  int ok = 0;
+  int cnum = ctx->error_depth;
+  int chnum = (int)sk_X509_num(ctx->chain) - 1;
   // if we have an alternative CRL issuer cert use that
   if (ctx->current_issuer) {
     issuer = ctx->current_issuer;
@@ -1612,6 +1609,7 @@ static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x) {
 }
 
 static int check_policy(X509_STORE_CTX *ctx) {
+  // TODO(davidben): Why do we disable policy validation for CRL paths?
   if (ctx->parent) {
     return 1;
   }
@@ -1692,11 +1690,11 @@ static int check_cert_time(X509_STORE_CTX *ctx, X509 *x) {
 }
 
 static int internal_verify(X509_STORE_CTX *ctx) {
-  int ok = 0, n;
+  int ok = 0;
   X509 *xs, *xi;
   EVP_PKEY *pkey = NULL;
 
-  n = sk_X509_num(ctx->chain);
+  int n = (int)sk_X509_num(ctx->chain);
   ctx->error_depth = n - 1;
   n--;
   xi = sk_X509_value(ctx->chain, n);
@@ -1777,7 +1775,7 @@ int X509_cmp_current_time(const ASN1_TIME *ctm) {
   return X509_cmp_time_posix(ctm, time(NULL));
 }
 
-int X509_cmp_time(const ASN1_TIME *ctm, time_t *cmp_time) {
+int X509_cmp_time(const ASN1_TIME *ctm, const time_t *cmp_time) {
   int64_t compare_time = (cmp_time == NULL) ? time(NULL) : *cmp_time;
   return X509_cmp_time_posix(ctm, compare_time);
 }
@@ -1795,12 +1793,12 @@ ASN1_TIME *X509_gmtime_adj(ASN1_TIME *s, long offset_sec) {
   return X509_time_adj(s, offset_sec, NULL);
 }
 
-ASN1_TIME *X509_time_adj(ASN1_TIME *s, long offset_sec, time_t *in_tm) {
+ASN1_TIME *X509_time_adj(ASN1_TIME *s, long offset_sec, const time_t *in_tm) {
   return X509_time_adj_ex(s, 0, offset_sec, in_tm);
 }
 
 ASN1_TIME *X509_time_adj_ex(ASN1_TIME *s, int offset_day, long offset_sec,
-                            time_t *in_tm) {
+                            const time_t *in_tm) {
   int64_t t = 0;
 
   if (in_tm) {

data/third_party/boringssl-with-bazel/src/crypto/x509/x509_vpm.c

@@ -350,9 +350,6 @@ int X509_VERIFY_PARAM_set1_name(X509_VERIFY_PARAM *param, const char *name) {
 
 int X509_VERIFY_PARAM_set_flags(X509_VERIFY_PARAM *param, unsigned long flags) {
   param->flags |= flags;
-  if (flags & X509_V_FLAG_POLICY_MASK) {
-    param->flags |= X509_V_FLAG_POLICY_CHECK;
-  }
   return 1;
 }
 
@@ -398,8 +395,6 @@ int X509_VERIFY_PARAM_add0_policy(X509_VERIFY_PARAM *param,
   if (!sk_ASN1_OBJECT_push(param->policies, policy)) {
     return 0;
   }
-  // TODO(davidben): This does not set |X509_V_FLAG_POLICY_CHECK|, while
-  // |X509_VERIFY_PARAM_set1_policies| does. Is this a bug?
   return 1;
 }
 
@@ -421,7 +416,6 @@ int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param,
     return 0;
   }
 
-  param->flags |= X509_V_FLAG_POLICY_CHECK;
   return 1;
 }
 
@@ -547,76 +541,11 @@ static const X509_VERIFY_PARAM default_table[] = {
      NULL,                     // policies
      vpm_empty_id}};
 
-static STACK_OF(X509_VERIFY_PARAM) *param_table = NULL;
-
-static int param_cmp(const X509_VERIFY_PARAM **a, const X509_VERIFY_PARAM **b) {
-  return strcmp((*a)->name, (*b)->name);
-}
-
-int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param) {
-  X509_VERIFY_PARAM *ptmp;
-  if (!param_table) {
-    param_table = sk_X509_VERIFY_PARAM_new(param_cmp);
-    if (!param_table) {
-      return 0;
-    }
-  } else {
-    size_t idx;
-
-    sk_X509_VERIFY_PARAM_sort(param_table);
-    if (sk_X509_VERIFY_PARAM_find(param_table, &idx, param)) {
-      ptmp = sk_X509_VERIFY_PARAM_value(param_table, idx);
-      X509_VERIFY_PARAM_free(ptmp);
-      (void)sk_X509_VERIFY_PARAM_delete(param_table, idx);
-    }
-  }
-  if (!sk_X509_VERIFY_PARAM_push(param_table, param)) {
-    return 0;
-  }
-  return 1;
-}
-
-int X509_VERIFY_PARAM_get_count(void) {
-  int num = sizeof(default_table) / sizeof(X509_VERIFY_PARAM);
-  if (param_table) {
-    num += sk_X509_VERIFY_PARAM_num(param_table);
-  }
-  return num;
-}
-
-const X509_VERIFY_PARAM *X509_VERIFY_PARAM_get0(int id) {
-  int num = sizeof(default_table) / sizeof(X509_VERIFY_PARAM);
-  if (id < num) {
-    return default_table + id;
-  }
-  return sk_X509_VERIFY_PARAM_value(param_table, id - num);
-}
-
 const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name) {
-  X509_VERIFY_PARAM pm;
-  unsigned i, limit;
-
-  pm.name = (char *)name;
-  if (param_table) {
-    size_t idx;
-    sk_X509_VERIFY_PARAM_sort(param_table);
-    if (sk_X509_VERIFY_PARAM_find(param_table, &idx, &pm)) {
-      return sk_X509_VERIFY_PARAM_value(param_table, idx);
-    }
-  }
-
-  limit = sizeof(default_table) / sizeof(X509_VERIFY_PARAM);
-  for (i = 0; i < limit; i++) {
+  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(default_table); i++) {
     if (strcmp(default_table[i].name, name) == 0) {
       return &default_table[i];
     }
   }
   return NULL;
 }
-
-void X509_VERIFY_PARAM_table_cleanup(void) {
-  if (param_table) {
-    sk_X509_VERIFY_PARAM_pop_free(param_table, X509_VERIFY_PARAM_free);
-  }
-  param_table = NULL;
-}

data/third_party/boringssl-with-bazel/src/crypto/x509/x509name.c

@@ -99,7 +99,7 @@ int X509_NAME_entry_count(const X509_NAME *name) {
   if (name == NULL) {
     return 0;
   }
-  return (sk_X509_NAME_ENTRY_num(name->entries));
+  return (int)sk_X509_NAME_ENTRY_num(name->entries);
 }
 
 int X509_NAME_get_index_by_NID(const X509_NAME *name, int nid, int lastpos) {
@@ -109,26 +109,22 @@ int X509_NAME_get_index_by_NID(const X509_NAME *name, int nid, int lastpos) {
   if (obj == NULL) {
     return -2;
   }
-  return (X509_NAME_get_index_by_OBJ(name, obj, lastpos));
+  return X509_NAME_get_index_by_OBJ(name, obj, lastpos);
 }
 
 // NOTE: you should be passsing -1, not 0 as lastpos
 int X509_NAME_get_index_by_OBJ(const X509_NAME *name, const ASN1_OBJECT *obj,
                                int lastpos) {
-  int n;
-  X509_NAME_ENTRY *ne;
-  STACK_OF(X509_NAME_ENTRY) *sk;
-
   if (name == NULL) {
     return -1;
   }
   if (lastpos < 0) {
     lastpos = -1;
   }
-  sk = name->entries;
-  n = sk_X509_NAME_ENTRY_num(sk);
+  const STACK_OF(X509_NAME_ENTRY) *sk = name->entries;
+  int n = (int)sk_X509_NAME_ENTRY_num(sk);
   for (lastpos++; lastpos < n; lastpos++) {
-    ne = sk_X509_NAME_ENTRY_value(sk, lastpos);
+    const X509_NAME_ENTRY *ne = sk_X509_NAME_ENTRY_value(sk, lastpos);
     if (OBJ_cmp(ne->object, obj) == 0) {
       return lastpos;
     }
@@ -153,9 +149,9 @@ X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc) {
 
   STACK_OF(X509_NAME_ENTRY) *sk = name->entries;
   X509_NAME_ENTRY *ret = sk_X509_NAME_ENTRY_delete(sk, loc);
-  int n = sk_X509_NAME_ENTRY_num(sk);
+  size_t n = sk_X509_NAME_ENTRY_num(sk);
   name->modified = 1;
-  if (loc == n) {
+  if ((size_t)loc == n) {
     return ret;
   }
 
@@ -170,7 +166,7 @@ X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc) {
   // If we removed a singleton RDN, update the RDN indices so they are
   // consecutive again.
   if (set_prev + 1 < set_next) {
-    for (int i = loc; i < n; i++) {
+    for (size_t i = loc; i < n; i++) {
       sk_X509_NAME_ENTRY_value(sk, i)->set--;
     }
   }
@@ -178,8 +174,8 @@ X509_NAME_ENTRY *X509_NAME_delete_entry(X509_NAME *name, int loc) {
 }
 
 int X509_NAME_add_entry_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj,
-                               int type, const unsigned char *bytes, int len,
-                               int loc, int set) {
+                               int type, const unsigned char *bytes,
+                               ossl_ssize_t len, int loc, int set) {
   X509_NAME_ENTRY *ne =
       X509_NAME_ENTRY_create_by_OBJ(NULL, obj, type, bytes, len);
   if (!ne) {
@@ -191,8 +187,8 @@ int X509_NAME_add_entry_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj,
 }
 
 int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
-                               const unsigned char *bytes, int len, int loc,
-                               int set) {
+                               const unsigned char *bytes, ossl_ssize_t len,
+                               int loc, int set) {
   X509_NAME_ENTRY *ne =
       X509_NAME_ENTRY_create_by_NID(NULL, nid, type, bytes, len);
   if (!ne) {
@@ -204,8 +200,8 @@ int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
 }
 
 int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
-                               const unsigned char *bytes, int len, int loc,
-                               int set) {
+                               const unsigned char *bytes, ossl_ssize_t len,
+                               int loc, int set) {
   X509_NAME_ENTRY *ne =
       X509_NAME_ENTRY_create_by_txt(NULL, field, type, bytes, len);
   if (!ne) {
@@ -221,14 +217,14 @@ int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
 int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *entry, int loc,
                         int set) {
   X509_NAME_ENTRY *new_name = NULL;
-  int n, i, inc;
+  int i, inc;
   STACK_OF(X509_NAME_ENTRY) *sk;
 
   if (name == NULL) {
     return 0;
   }
   sk = name->entries;
-  n = sk_X509_NAME_ENTRY_num(sk);
+  int n = (int)sk_X509_NAME_ENTRY_num(sk);
   if (loc > n) {
     loc = n;
   } else if (loc < 0) {
@@ -266,7 +262,7 @@ int X509_NAME_add_entry(X509_NAME *name, const X509_NAME_ENTRY *entry, int loc,
     goto err;
   }
   if (inc) {
-    n = sk_X509_NAME_ENTRY_num(sk);
+    n = (int)sk_X509_NAME_ENTRY_num(sk);
     for (i = loc + 1; i < n; i++) {
       sk_X509_NAME_ENTRY_value(sk, i)->set += 1;
     }
@@ -282,7 +278,7 @@ err:
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
                                                const char *field, int type,
                                                const unsigned char *bytes,
-                                               int len) {
+                                               ossl_ssize_t len) {
   ASN1_OBJECT *obj;
   X509_NAME_ENTRY *nentry;
 
@@ -300,7 +296,7 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
                                                int type,
                                                const unsigned char *bytes,
-                                               int len) {
+                                               ossl_ssize_t len) {
   const ASN1_OBJECT *obj = OBJ_nid2obj(nid);
   if (obj == NULL) {
     OPENSSL_PUT_ERROR(X509, X509_R_UNKNOWN_NID);
@@ -312,7 +308,7 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
                                                const ASN1_OBJECT *obj, int type,
                                                const unsigned char *bytes,
-                                               int len) {
+                                               ossl_ssize_t len) {
   X509_NAME_ENTRY *ret;
 
   if ((ne == NULL) || (*ne == NULL)) {
@@ -352,9 +348,7 @@ int X509_NAME_ENTRY_set_object(X509_NAME_ENTRY *ne, const ASN1_OBJECT *obj) {
 }
 
 int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type,
-                             const unsigned char *bytes, int len) {
-  int i;
-
+                             const unsigned char *bytes, ossl_ssize_t len) {
   if ((ne == NULL) || ((bytes == NULL) && (len != 0))) {
     return 0;
   }
@@ -367,8 +361,7 @@ int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type,
   if (len < 0) {
     len = strlen((const char *)bytes);
   }
-  i = ASN1_STRING_set(ne->value, bytes, len);
-  if (!i) {
+  if (!ASN1_STRING_set(ne->value, bytes, len)) {
     return 0;
   }
   if (type != V_ASN1_UNDEF) {

data/third_party/boringssl-with-bazel/src/crypto/x509/x509spki.c

@@ -77,7 +77,7 @@ EVP_PKEY *NETSCAPE_SPKI_get_pubkey(NETSCAPE_SPKI *x) {
 
 // Load a Netscape SPKI from a base64 encoded string
 
-NETSCAPE_SPKI *NETSCAPE_SPKI_b64_decode(const char *str, int len) {
+NETSCAPE_SPKI *NETSCAPE_SPKI_b64_decode(const char *str, ossl_ssize_t len) {
   unsigned char *spki_der;
   const unsigned char *p;
   size_t spki_len;

data/third_party/boringssl-with-bazel/src/crypto/x509/x_crl.c

@@ -71,7 +71,8 @@
 #include "../internal.h"
 #include "internal.h"
 
-static int X509_REVOKED_cmp(const X509_REVOKED **a, const X509_REVOKED **b);
+static int X509_REVOKED_cmp(const X509_REVOKED *const *a,
+                            const X509_REVOKED *const *b);
 static int setup_idp(X509_CRL *crl, ISSUING_DIST_POINT *idp);
 
 ASN1_SEQUENCE(X509_REVOKED) = {
@@ -361,7 +362,8 @@ IMPLEMENT_ASN1_FUNCTIONS(X509_CRL_INFO)
 IMPLEMENT_ASN1_FUNCTIONS(X509_CRL)
 IMPLEMENT_ASN1_DUP_FUNCTION(X509_CRL)
 
-static int X509_REVOKED_cmp(const X509_REVOKED **a, const X509_REVOKED **b) {
+static int X509_REVOKED_cmp(const X509_REVOKED *const *a,
+                            const X509_REVOKED *const *b) {
   return ASN1_STRING_cmp((*a)->serialNumber, (*b)->serialNumber);
 }
 
@@ -428,7 +430,7 @@ static int crl_revoked_issuer_match(X509_CRL *crl, X509_NAME *nm,
   return 0;
 }
 
-static struct CRYPTO_STATIC_MUTEX g_crl_sort_lock = CRYPTO_STATIC_MUTEX_INIT;
+static CRYPTO_MUTEX g_crl_sort_lock = CRYPTO_MUTEX_INIT;
 
 static int crl_lookup(X509_CRL *crl, X509_REVOKED **ret, ASN1_INTEGER *serial,
                       X509_NAME *issuer) {
@@ -441,16 +443,16 @@ static int crl_lookup(X509_CRL *crl, X509_REVOKED **ret, ASN1_INTEGER *serial,
   // Sort revoked into serial number order if not already sorted. Do this
   // under a lock to avoid race condition.
 
-  CRYPTO_STATIC_MUTEX_lock_read(&g_crl_sort_lock);
+  CRYPTO_MUTEX_lock_read(&g_crl_sort_lock);
   const int is_sorted = sk_X509_REVOKED_is_sorted(crl->crl->revoked);
-  CRYPTO_STATIC_MUTEX_unlock_read(&g_crl_sort_lock);
+  CRYPTO_MUTEX_unlock_read(&g_crl_sort_lock);
 
   if (!is_sorted) {
-    CRYPTO_STATIC_MUTEX_lock_write(&g_crl_sort_lock);
+    CRYPTO_MUTEX_lock_write(&g_crl_sort_lock);
     if (!sk_X509_REVOKED_is_sorted(crl->crl->revoked)) {
       sk_X509_REVOKED_sort(crl->crl->revoked);
     }
-    CRYPTO_STATIC_MUTEX_unlock_write(&g_crl_sort_lock);
+    CRYPTO_MUTEX_unlock_write(&g_crl_sort_lock);
   }
 
   if (!sk_X509_REVOKED_find(crl->crl->revoked, &idx, &rtmp)) {

data/third_party/boringssl-with-bazel/src/crypto/x509/x_name.c

@@ -230,7 +230,7 @@ static int x509_name_ex_d2i(ASN1_VALUE **val, const unsigned char **in,
     entries = sk_STACK_OF_X509_NAME_ENTRY_value(intname, i);
     for (j = 0; j < sk_X509_NAME_ENTRY_num(entries); j++) {
       entry = sk_X509_NAME_ENTRY_value(entries, j);
-      entry->set = i;
+      entry->set = (int)i;
       if (!sk_X509_NAME_ENTRY_push(nm->entries, entry)) {
         goto err;
       }

data/third_party/boringssl-with-bazel/src/crypto/x509/x_pubkey.c

@@ -128,7 +128,7 @@ error:
 // |X509_PUBKEY| objects. Really |X509_PUBKEY| should have a |CRYPTO_once_t|
 // inside it for this, but |CRYPTO_once_t| is private and |X509_PUBKEY| is
 // not.
-static struct CRYPTO_STATIC_MUTEX g_pubkey_lock = CRYPTO_STATIC_MUTEX_INIT;
+static CRYPTO_MUTEX g_pubkey_lock = CRYPTO_MUTEX_INIT;
 
 EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key) {
   EVP_PKEY *ret = NULL;
@@ -138,13 +138,13 @@ EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key) {
     goto error;
   }
 
-  CRYPTO_STATIC_MUTEX_lock_read(&g_pubkey_lock);
+  CRYPTO_MUTEX_lock_read(&g_pubkey_lock);
   if (key->pkey != NULL) {
-    CRYPTO_STATIC_MUTEX_unlock_read(&g_pubkey_lock);
+    CRYPTO_MUTEX_unlock_read(&g_pubkey_lock);
     EVP_PKEY_up_ref(key->pkey);
     return key->pkey;
   }
-  CRYPTO_STATIC_MUTEX_unlock_read(&g_pubkey_lock);
+  CRYPTO_MUTEX_unlock_read(&g_pubkey_lock);
 
   // Re-encode the |X509_PUBKEY| to DER and parse it.
   int spki_len = i2d_X509_PUBKEY(key, &spki);
@@ -160,14 +160,14 @@ EVP_PKEY *X509_PUBKEY_get(X509_PUBKEY *key) {
   }
 
   // Check to see if another thread set key->pkey first
-  CRYPTO_STATIC_MUTEX_lock_write(&g_pubkey_lock);
+  CRYPTO_MUTEX_lock_write(&g_pubkey_lock);
   if (key->pkey) {
-    CRYPTO_STATIC_MUTEX_unlock_write(&g_pubkey_lock);
+    CRYPTO_MUTEX_unlock_write(&g_pubkey_lock);
     EVP_PKEY_free(ret);
     ret = key->pkey;
   } else {
     key->pkey = ret;
-    CRYPTO_STATIC_MUTEX_unlock_write(&g_pubkey_lock);
+    CRYPTO_MUTEX_unlock_write(&g_pubkey_lock);
   }
 
   OPENSSL_free(spki);

data/third_party/boringssl-with-bazel/src/crypto/x509/x_x509a.c

@@ -90,7 +90,7 @@ static X509_CERT_AUX *aux_get(X509 *x) {
   return x->aux;
 }
 
-int X509_alias_set1(X509 *x, const unsigned char *name, int len) {
+int X509_alias_set1(X509 *x, const unsigned char *name, ossl_ssize_t len) {
   X509_CERT_AUX *aux;
   // TODO(davidben): Empty aliases are not meaningful in PKCS#12, and the
   // getters cannot quite represent them. Also erase the object if |len| is
@@ -112,7 +112,7 @@ int X509_alias_set1(X509 *x, const unsigned char *name, int len) {
   return ASN1_STRING_set(aux->alias, name, len);
 }
 
-int X509_keyid_set1(X509 *x, const unsigned char *id, int len) {
+int X509_keyid_set1(X509 *x, const unsigned char *id, ossl_ssize_t len) {
   X509_CERT_AUX *aux;
   // TODO(davidben): Empty key IDs are not meaningful in PKCS#12, and the
   // getters cannot quite represent them. Also erase the object if |len| is

data/third_party/boringssl-with-bazel/src/crypto/x509v3/internal.h

@@ -90,7 +90,7 @@ OPENSSL_EXPORT char *x509v3_bytes_to_hex(const uint8_t *in, size_t len);
 //
 // This function was historically named |string_to_hex| in OpenSSL. Despite the
 // name, |string_to_hex| converted from hex.
-unsigned char *x509v3_hex_to_bytes(const char *str, long *len);
+unsigned char *x509v3_hex_to_bytes(const char *str, size_t *len);
 
 // x509v3_conf_name_matches returns one if |name| is equal to |cmp| or begins
 // with |cmp| followed by '.', and zero otherwise.

data/third_party/boringssl-with-bazel/src/crypto/x509v3/v3_alt.c

@@ -173,13 +173,12 @@ STACK_OF(CONF_VALUE) *i2v_GENERAL_NAME(const X509V3_EXT_METHOD *method,
     case GEN_IPADD:
       p = gen->d.ip->data;
       if (gen->d.ip->length == 4) {
-        BIO_snprintf(oline, sizeof(oline), "%d.%d.%d.%d", p[0], p[1], p[2],
-                     p[3]);
+        snprintf(oline, sizeof(oline), "%d.%d.%d.%d", p[0], p[1], p[2], p[3]);
       } else if (gen->d.ip->length == 16) {
         oline[0] = 0;
         for (i = 0; i < 8; i++) {
           uint16_t v = ((uint16_t)p[0] << 8) | p[1];
-          BIO_snprintf(htmp, sizeof(htmp), "%X", v);
+          snprintf(htmp, sizeof(htmp), "%X", v);
           p += 2;
           OPENSSL_strlcat(oline, htmp, sizeof(oline));
           if (i != 7) {