grpc 1.56.2 → 1.57.0.pre1

data/third_party/boringssl-with-bazel/src/crypto/curve25519/internal.h

@@ -15,14 +15,13 @@
 #ifndef OPENSSL_HEADER_CURVE25519_INTERNAL_H
 #define OPENSSL_HEADER_CURVE25519_INTERNAL_H
 
-#if defined(__cplusplus)
-extern "C" {
-#endif
-
-#include <openssl/base.h>
+#include <openssl/curve25519.h>
 
 #include "../internal.h"
 
+#if defined(__cplusplus)
+extern "C" {
+#endif
 
 #if defined(OPENSSL_ARM) && !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_APPLE)
 #define BORINGSSL_X25519_NEON
@@ -32,6 +31,27 @@ void x25519_NEON(uint8_t out[32], const uint8_t scalar[32],
                  const uint8_t point[32]);
 #endif
 
+#if !defined(OPENSSL_NO_ASM) && !defined(OPENSSL_SMALL) && \
+    defined(__GNUC__) && defined(__x86_64__)
+#define BORINGSSL_FE25519_ADX
+
+// fiat_curve25519_adx_mul is defined in
+// third_party/fiat/asm/fiat_curve25519_adx_mul.S
+void __attribute__((sysv_abi))
+fiat_curve25519_adx_mul(uint64_t out[4], const uint64_t in1[4],
+                        const uint64_t in2[4]);
+
+// fiat_curve25519_adx_square is defined in
+// third_party/fiat/asm/fiat_curve25519_adx_square.S
+void __attribute__((sysv_abi))
+fiat_curve25519_adx_square(uint64_t out[4], const uint64_t in[4]);
+
+// x25519_scalar_mult_adx is defined in third_party/fiat/curve25519_64_adx.h
+void x25519_scalar_mult_adx(uint8_t out[32], const uint8_t scalar[32],
+                            const uint8_t point[32]);
+void x25519_ge_scalarmult_base_adx(uint8_t h[4][32], const uint8_t a[32]);
+#endif
+
 #if defined(OPENSSL_64_BIT)
 // fe means field element. Here the field is \Z/(2^255-19). An element t,
 // entries t[0]...t[4], represents the integer t[0]+2^51 t[1]+2^102 t[2]+2^153
@@ -135,6 +155,8 @@ struct spake2_ctx_st {
 };
 
 
+extern const uint8_t k25519Precomp[32][8][3][32];
+
 #if defined(__cplusplus)
 }  // extern C
 #endif

data/third_party/boringssl-with-bazel/src/crypto/dsa/internal.h

@@ -17,11 +17,31 @@
 
 #include <openssl/dsa.h>
 
+#include <openssl/thread.h>
+
+#include "../internal.h"
+
 #if defined(__cplusplus)
 extern "C" {
 #endif
 
 
+struct dsa_st {
+  BIGNUM *p;
+  BIGNUM *q;
+  BIGNUM *g;
+
+  BIGNUM *pub_key;
+  BIGNUM *priv_key;
+
+  // Normally used to cache montgomery values
+  CRYPTO_MUTEX method_mont_lock;
+  BN_MONT_CTX *method_mont_p;
+  BN_MONT_CTX *method_mont_q;
+  CRYPTO_refcount_t references;
+  CRYPTO_EX_DATA ex_data;
+};
+
 // dsa_check_key performs cheap self-checks on |dsa|, and ensures it is within
 // DoS bounds. It returns one on success and zero on error.
 int dsa_check_key(const DSA *dsa);

data/third_party/boringssl-with-bazel/src/crypto/ec_extra/ec_asn1.c

@@ -72,6 +72,16 @@ static const CBS_ASN1_TAG kParametersTag =
 static const CBS_ASN1_TAG kPublicKeyTag =
     CBS_ASN1_CONSTRUCTED | CBS_ASN1_CONTEXT_SPECIFIC | 1;
 
+// TODO(https://crbug.com/boringssl/497): Allow parsers to specify a list of
+// acceptable groups, so parsers don't have to pull in all four.
+typedef const EC_GROUP *(*ec_group_func)(void);
+static const ec_group_func kAllGroups[] = {
+    &EC_group_p224,
+    &EC_group_p256,
+    &EC_group_p384,
+    &EC_group_p521,
+};
+
 EC_KEY *EC_KEY_parse_private_key(CBS *cbs, const EC_GROUP *group) {
   CBS ec_private_key, private_key;
   uint64_t version;
@@ -84,7 +94,6 @@ EC_KEY *EC_KEY_parse_private_key(CBS *cbs, const EC_GROUP *group) {
   }
 
   // Parse the optional parameters field.
-  EC_GROUP *inner_group = NULL;
   EC_KEY *ret = NULL;
   BIGNUM *priv_key = NULL;
   if (CBS_peek_asn1_tag(&ec_private_key, kParametersTag)) {
@@ -97,7 +106,7 @@ EC_KEY *EC_KEY_parse_private_key(CBS *cbs, const EC_GROUP *group) {
       OPENSSL_PUT_ERROR(EC, EC_R_DECODE_ERROR);
       goto err;
     }
-    inner_group = EC_KEY_parse_parameters(&child);
+    const EC_GROUP *inner_group = EC_KEY_parse_parameters(&child);
     if (inner_group == NULL) {
       goto err;
     }
@@ -179,13 +188,11 @@ EC_KEY *EC_KEY_parse_private_key(CBS *cbs, const EC_GROUP *group) {
   }
 
   BN_free(priv_key);
-  EC_GROUP_free(inner_group);
   return ret;
 
 err:
   EC_KEY_free(ret);
   BN_free(priv_key);
-  EC_GROUP_free(inner_group);
   return NULL;
 }
 
@@ -244,9 +251,12 @@ int EC_KEY_marshal_private_key(CBB *cbb, const EC_KEY *key,
 // kPrimeFieldOID is the encoding of 1.2.840.10045.1.1.
 static const uint8_t kPrimeField[] = {0x2a, 0x86, 0x48, 0xce, 0x3d, 0x01, 0x01};
 
-static int parse_explicit_prime_curve(CBS *in, CBS *out_prime, CBS *out_a,
-                                      CBS *out_b, CBS *out_base_x,
-                                      CBS *out_base_y, CBS *out_order) {
+struct explicit_prime_curve {
+  CBS prime, a, b, base_x, base_y, order;
+};
+
+static int parse_explicit_prime_curve(CBS *in,
+                                      struct explicit_prime_curve *out) {
   // See RFC 3279, section 2.3.5. Note that RFC 3279 calls this structure an
   // ECParameters while RFC 5480 calls it a SpecifiedECDomain.
   CBS params, field_id, field_type, curve, base, cofactor;
@@ -260,18 +270,18 @@ static int parse_explicit_prime_curve(CBS *in, CBS *out_prime, CBS *out_a,
       CBS_len(&field_type) != sizeof(kPrimeField) ||
       OPENSSL_memcmp(CBS_data(&field_type), kPrimeField, sizeof(kPrimeField)) !=
           0 ||
-      !CBS_get_asn1(&field_id, out_prime, CBS_ASN1_INTEGER) ||
-      !CBS_is_unsigned_asn1_integer(out_prime) ||
+      !CBS_get_asn1(&field_id, &out->prime, CBS_ASN1_INTEGER) ||
+      !CBS_is_unsigned_asn1_integer(&out->prime) ||
       CBS_len(&field_id) != 0 ||
       !CBS_get_asn1(&params, &curve, CBS_ASN1_SEQUENCE) ||
-      !CBS_get_asn1(&curve, out_a, CBS_ASN1_OCTETSTRING) ||
-      !CBS_get_asn1(&curve, out_b, CBS_ASN1_OCTETSTRING) ||
+      !CBS_get_asn1(&curve, &out->a, CBS_ASN1_OCTETSTRING) ||
+      !CBS_get_asn1(&curve, &out->b, CBS_ASN1_OCTETSTRING) ||
       // |curve| has an optional BIT STRING seed which we ignore.
       !CBS_get_optional_asn1(&curve, NULL, NULL, CBS_ASN1_BITSTRING) ||
       CBS_len(&curve) != 0 ||
       !CBS_get_asn1(&params, &base, CBS_ASN1_OCTETSTRING) ||
-      !CBS_get_asn1(&params, out_order, CBS_ASN1_INTEGER) ||
-      !CBS_is_unsigned_asn1_integer(out_order) ||
+      !CBS_get_asn1(&params, &out->order, CBS_ASN1_INTEGER) ||
+      !CBS_is_unsigned_asn1_integer(&out->order) ||
       !CBS_get_optional_asn1(&params, &cofactor, &has_cofactor,
                              CBS_ASN1_INTEGER) ||
       CBS_len(&params) != 0) {
@@ -300,25 +310,33 @@ static int parse_explicit_prime_curve(CBS *in, CBS *out_prime, CBS *out_a,
     return 0;
   }
   size_t field_len = CBS_len(&base) / 2;
-  CBS_init(out_base_x, CBS_data(&base), field_len);
-  CBS_init(out_base_y, CBS_data(&base) + field_len, field_len);
+  CBS_init(&out->base_x, CBS_data(&base), field_len);
+  CBS_init(&out->base_y, CBS_data(&base) + field_len, field_len);
 
   return 1;
 }
 
-// integers_equal returns one if |a| and |b| are equal, up to leading zeros, and
+// integers_equal returns one if |bytes| is a big-endian encoding of |bn|, and
 // zero otherwise.
-static int integers_equal(const CBS *a, const uint8_t *b, size_t b_len) {
-  // Remove leading zeros from |a| and |b|.
-  CBS a_copy = *a;
-  while (CBS_len(&a_copy) > 0 && CBS_data(&a_copy)[0] == 0) {
-    CBS_skip(&a_copy, 1);
+static int integers_equal(const CBS *bytes, const BIGNUM *bn) {
+  // Although, in SEC 1, Field-Element-to-Octet-String has a fixed width,
+  // OpenSSL mis-encodes the |a| and |b|, so we tolerate any number of leading
+  // zeros. (This matters for P-521 whose |b| has a leading 0.)
+  CBS copy = *bytes;
+  while (CBS_len(&copy) > 0 && CBS_data(&copy)[0] == 0) {
+    CBS_skip(&copy, 1);
   }
-  while (b_len > 0 && b[0] == 0) {
-    b++;
-    b_len--;
+
+  if (CBS_len(&copy) > EC_MAX_BYTES) {
+    return 0;
   }
-  return CBS_mem_equal(&a_copy, b, b_len);
+  uint8_t buf[EC_MAX_BYTES];
+  if (!BN_bn2bin_padded(buf, CBS_len(&copy), bn)) {
+    ERR_clear_error();
+    return 0;
+  }
+
+  return CBS_mem_equal(&copy, buf, CBS_len(&copy));
 }
 
 EC_GROUP *EC_KEY_parse_curve_name(CBS *cbs) {
@@ -329,13 +347,10 @@ EC_GROUP *EC_KEY_parse_curve_name(CBS *cbs) {
   }
 
   // Look for a matching curve.
-  const struct built_in_curves *const curves = OPENSSL_built_in_curves();
-  for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) {
-    const struct built_in_curve *curve = &curves->curves[i];
-    if (CBS_len(&named_curve) == curve->oid_len &&
-        OPENSSL_memcmp(CBS_data(&named_curve), curve->oid, curve->oid_len) ==
-            0) {
-      return EC_GROUP_new_by_curve_name(curve->nid);
+  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kAllGroups); i++) {
+    const EC_GROUP *group = kAllGroups[i]();
+    if (CBS_mem_equal(&named_curve, group->oid, group->oid_len)) {
+      return (EC_GROUP *)group;
     }
   }
 
@@ -344,25 +359,15 @@ EC_GROUP *EC_KEY_parse_curve_name(CBS *cbs) {
 }
 
 int EC_KEY_marshal_curve_name(CBB *cbb, const EC_GROUP *group) {
-  int nid = EC_GROUP_get_curve_name(group);
-  if (nid == NID_undef) {
+  if (group->oid_len == 0) {
     OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
     return 0;
   }
 
-  const struct built_in_curves *const curves = OPENSSL_built_in_curves();
-  for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) {
-    const struct built_in_curve *curve = &curves->curves[i];
-    if (curve->nid == nid) {
-      CBB child;
-      return CBB_add_asn1(cbb, &child, CBS_ASN1_OBJECT) &&
-             CBB_add_bytes(&child, curve->oid, curve->oid_len) &&
-             CBB_flush(cbb);
-    }
-  }
-
-  OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
-  return 0;
+  CBB child;
+  return CBB_add_asn1(cbb, &child, CBS_ASN1_OBJECT) &&
+         CBB_add_bytes(&child, group->oid, group->oid_len) &&  //
+         CBB_flush(cbb);
 }
 
 EC_GROUP *EC_KEY_parse_parameters(CBS *cbs) {
@@ -374,34 +379,56 @@ EC_GROUP *EC_KEY_parse_parameters(CBS *cbs) {
   // of named curves.
   //
   // TODO(davidben): Remove support for this.
-  CBS prime, a, b, base_x, base_y, order;
-  if (!parse_explicit_prime_curve(cbs, &prime, &a, &b, &base_x, &base_y,
-                                  &order)) {
+  struct explicit_prime_curve curve;
+  if (!parse_explicit_prime_curve(cbs, &curve)) {
     return NULL;
   }
 
-  // Look for a matching prime curve.
-  const struct built_in_curves *const curves = OPENSSL_built_in_curves();
-  for (size_t i = 0; i < OPENSSL_NUM_BUILT_IN_CURVES; i++) {
-    const struct built_in_curve *curve = &curves->curves[i];
-    const unsigned param_len = curve->param_len;
-    // |curve->params| is ordered p, a, b, x, y, order, each component
-    // zero-padded up to the field length. Although SEC 1 states that the
-    // Field-Element-to-Octet-String conversion also pads, OpenSSL mis-encodes
-    // |a| and |b|, so this comparison must allow omitting leading zeros. (This
-    // is relevant for P-521 whose |b| has a leading 0.)
-    if (integers_equal(&prime, curve->params, param_len) &&
-        integers_equal(&a, curve->params + param_len, param_len) &&
-        integers_equal(&b, curve->params + param_len * 2, param_len) &&
-        integers_equal(&base_x, curve->params + param_len * 3, param_len) &&
-        integers_equal(&base_y, curve->params + param_len * 4, param_len) &&
-        integers_equal(&order, curve->params + param_len * 5, param_len)) {
-      return EC_GROUP_new_by_curve_name(curve->nid);
+  const EC_GROUP *ret = NULL;
+  BIGNUM *p = BN_new(), *a = BN_new(), *b = BN_new(), *x = BN_new(),
+         *y = BN_new();
+  if (p == NULL || a == NULL || b == NULL || x == NULL || y == NULL) {
+    goto err;
+  }
+
+  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(kAllGroups); i++) {
+    const EC_GROUP *group = kAllGroups[i]();
+    if (!integers_equal(&curve.order, EC_GROUP_get0_order(group))) {
+      continue;
+    }
+
+    // The order alone uniquely identifies the group, but we check the other
+    // parameters to avoid misinterpreting the group.
+    if (!EC_GROUP_get_curve_GFp(group, p, a, b, NULL)) {
+      goto err;
+    }
+    if (!integers_equal(&curve.prime, p) || !integers_equal(&curve.a, a) ||
+        !integers_equal(&curve.b, b)) {
+      break;
+    }
+    if (!EC_POINT_get_affine_coordinates_GFp(
+            group, EC_GROUP_get0_generator(group), x, y, NULL)) {
+      goto err;
     }
+    if (!integers_equal(&curve.base_x, x) ||
+        !integers_equal(&curve.base_y, y)) {
+      break;
+    }
+    ret = group;
+    break;
   }
 
-  OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
-  return NULL;
+  if (ret == NULL) {
+    OPENSSL_PUT_ERROR(EC, EC_R_UNKNOWN_GROUP);
+  }
+
+err:
+  BN_free(p);
+  BN_free(a);
+  BN_free(b);
+  BN_free(x);
+  BN_free(y);
+  return (EC_GROUP *)ret;
 }
 
 int EC_POINT_point2cbb(CBB *out, const EC_GROUP *group, const EC_POINT *point,
@@ -458,18 +485,16 @@ EC_KEY *d2i_ECParameters(EC_KEY **out_key, const uint8_t **inp, long len) {
 
   CBS cbs;
   CBS_init(&cbs, *inp, (size_t)len);
-  EC_GROUP *group = EC_KEY_parse_parameters(&cbs);
+  const EC_GROUP *group = EC_KEY_parse_parameters(&cbs);
   if (group == NULL) {
     return NULL;
   }
 
   EC_KEY *ret = EC_KEY_new();
   if (ret == NULL || !EC_KEY_set_group(ret, group)) {
-    EC_GROUP_free(group);
     EC_KEY_free(ret);
     return NULL;
   }
-  EC_GROUP_free(group);
 
   if (out_key != NULL) {
     EC_KEY_free(*out_key);
@@ -532,3 +557,16 @@ int i2o_ECPublicKey(const EC_KEY *key, uint8_t **outp) {
   // Historically, this function used the wrong return value on error.
   return ret > 0 ? ret : 0;
 }
+
+size_t EC_get_builtin_curves(EC_builtin_curve *out_curves,
+                             size_t max_num_curves) {
+  if (max_num_curves > OPENSSL_ARRAY_SIZE(kAllGroups)) {
+    max_num_curves = OPENSSL_ARRAY_SIZE(kAllGroups);
+  }
+  for (size_t i = 0; i < max_num_curves; i++) {
+    const EC_GROUP *group = kAllGroups[i]();
+    out_curves[i].nid = group->curve_name;
+    out_curves[i].comment = group->comment;
+  }
+  return OPENSSL_ARRAY_SIZE(kAllGroups);
+}

data/third_party/boringssl-with-bazel/src/crypto/ec_extra/ec_derive.c

@@ -55,7 +55,8 @@ EC_KEY *EC_KEY_derive_from_secret(const EC_GROUP *group, const uint8_t *secret,
   }
 
   uint8_t derived[EC_KEY_DERIVE_EXTRA_BYTES + EC_MAX_BYTES];
-  size_t derived_len = BN_num_bytes(&group->order) + EC_KEY_DERIVE_EXTRA_BYTES;
+  size_t derived_len =
+      BN_num_bytes(EC_GROUP_get0_order(group)) + EC_KEY_DERIVE_EXTRA_BYTES;
   assert(derived_len <= sizeof(derived));
   if (!HKDF(derived, derived_len, EVP_sha256(), secret, secret_len,
             /*salt=*/NULL, /*salt_len=*/0, (const uint8_t *)info,
@@ -74,10 +75,10 @@ EC_KEY *EC_KEY_derive_from_secret(const EC_GROUP *group, const uint8_t *secret,
       // enough. 2^(num_bytes(order)) < 2^8 * order, so:
       //
       //    priv < 2^8 * order * 2^128 < order * order < order * R
-      !BN_from_montgomery(priv, priv, group->order_mont, ctx) ||
+      !BN_from_montgomery(priv, priv, &group->order, ctx) ||
       // Multiply by R^2 and do another Montgomery reduction to compute
       // priv * R^-1 * R^2 * R^-1 = priv mod order.
-      !BN_to_montgomery(priv, priv, group->order_mont, ctx) ||
+      !BN_to_montgomery(priv, priv, &group->order, ctx) ||
       !EC_POINT_mul(group, pub, priv, NULL, NULL, ctx) ||
       !EC_KEY_set_group(key, group) || !EC_KEY_set_public_key(key, pub) ||
       !EC_KEY_set_private_key(key, priv)) {

data/third_party/boringssl-with-bazel/src/crypto/ec_extra/hash_to_curve.c

@@ -179,12 +179,12 @@ static int hash_to_field2(const EC_GROUP *group, const EVP_MD *md,
                           size_t msg_len) {
   size_t L;
   uint8_t buf[4 * EC_MAX_BYTES];
-  if (!num_bytes_to_derive(&L, &group->field, k) ||
+  if (!num_bytes_to_derive(&L, &group->field.N, k) ||
       !expand_message_xmd(md, buf, 2 * L, msg, msg_len, dst, dst_len)) {
     return 0;
   }
   BN_ULONG words[2 * EC_MAX_WORDS];
-  size_t num_words = 2 * group->field.width;
+  size_t num_words = 2 * group->field.N.width;
   big_endian_to_words(words, num_words, buf, L);
   group->meth->felem_reduce(group, out1, words, num_words);
   big_endian_to_words(words, num_words, buf + L, L);
@@ -197,15 +197,16 @@ static int hash_to_field2(const EC_GROUP *group, const EVP_MD *md,
 static int hash_to_scalar(const EC_GROUP *group, const EVP_MD *md,
                           EC_SCALAR *out, const uint8_t *dst, size_t dst_len,
                           unsigned k, const uint8_t *msg, size_t msg_len) {
+  const BIGNUM *order = EC_GROUP_get0_order(group);
   size_t L;
   uint8_t buf[EC_MAX_BYTES * 2];
-  if (!num_bytes_to_derive(&L, &group->order, k) ||
+  if (!num_bytes_to_derive(&L, order, k) ||
       !expand_message_xmd(md, buf, L, msg, msg_len, dst, dst_len)) {
     return 0;
   }
 
   BN_ULONG words[2 * EC_MAX_WORDS];
-  size_t num_words = 2 * group->order.width;
+  size_t num_words = 2 * order->width;
   big_endian_to_words(words, num_words, buf, L);
   ec_scalar_reduce(group, out, words, num_words);
   return 1;
@@ -230,7 +231,7 @@ static BN_ULONG sgn0(const EC_GROUP *group, const EC_FELEM *a) {
 }
 
 OPENSSL_UNUSED static int is_3mod4(const EC_GROUP *group) {
-  return group->field.width > 0 && (group->field.d[0] & 3) == 3;
+  return group->field.N.width > 0 && (group->field.N.d[0] & 3) == 3;
 }
 
 // sqrt_ratio_3mod4 implements the operation described in appendix F.2.1.2
@@ -285,12 +286,12 @@ static void map_to_curve_simple_swu(const EC_GROUP *group, const EC_FELEM *Z,
       group->meth->felem_sqr;
 
   EC_FELEM tv1, tv2, tv3, tv4, tv5, tv6, x, y, y1;
-  felem_sqr(group, &tv1, u);                     // 1. tv1 = u^2
-  felem_mul(group, &tv1, Z, &tv1);               // 2. tv1 = Z * tv1
-  felem_sqr(group, &tv2, &tv1);                  // 3. tv2 = tv1^2
-  ec_felem_add(group, &tv2, &tv2, &tv1);         // 4. tv2 = tv2 + tv1
-  ec_felem_add(group, &tv3, &tv2, &group->one);  // 5. tv3 = tv2 + 1
-  felem_mul(group, &tv3, &group->b, &tv3);       // 6. tv3 = B * tv3
+  felem_sqr(group, &tv1, u);                             // 1. tv1 = u^2
+  felem_mul(group, &tv1, Z, &tv1);                       // 2. tv1 = Z * tv1
+  felem_sqr(group, &tv2, &tv1);                          // 3. tv2 = tv1^2
+  ec_felem_add(group, &tv2, &tv2, &tv1);                 // 4. tv2 = tv2 + tv1
+  ec_felem_add(group, &tv3, &tv2, ec_felem_one(group));  // 5. tv3 = tv2 + 1
+  felem_mul(group, &tv3, &group->b, &tv3);               // 6. tv3 = B * tv3
 
   // 7. tv4 = CMOV(Z, -tv2, tv2 != 0)
   const BN_ULONG tv2_non_zero = ec_felem_non_zero_mask(group, &tv2);
@@ -353,8 +354,8 @@ static int hash_to_curve(const EC_GROUP *group, const EVP_MD *md,
 
   // Compute |c1| = (p - 3) / 4.
   BN_ULONG c1[EC_MAX_WORDS];
-  size_t num_c1 = group->field.width;
-  if (!bn_copy_words(c1, num_c1, &group->field)) {
+  size_t num_c1 = group->field.N.width;
+  if (!bn_copy_words(c1, num_c1, &group->field.N)) {
     return 0;
   }
   bn_rshift_words(c1, c1, /*shift=*/2, /*num=*/num_c1);
@@ -370,7 +371,7 @@ static int hash_to_curve(const EC_GROUP *group, const EVP_MD *md,
 
 static int felem_from_u8(const EC_GROUP *group, EC_FELEM *out, uint8_t a) {
   uint8_t bytes[EC_MAX_BYTES] = {0};
-  size_t len = BN_num_bytes(&group->field);
+  size_t len = BN_num_bytes(&group->field.N);
   bytes[len - 1] = a;
   return ec_felem_from_bytes(group, out, bytes, len);
 }

data/third_party/boringssl-with-bazel/src/crypto/err/err.c

@@ -146,13 +146,13 @@ struct err_error_st {
 
 // ERR_STATE contains the per-thread, error queue.
 typedef struct err_state_st {
-  // errors contains the ERR_NUM_ERRORS most recent errors, organised as a ring
-  // buffer.
+  // errors contains up to ERR_NUM_ERRORS - 1 most recent errors, organised as a
+  // ring buffer.
   struct err_error_st errors[ERR_NUM_ERRORS];
-  // top contains the index one past the most recent error. If |top| equals
-  // |bottom| then the queue is empty.
+  // top contains the index of the most recent error. If |top| equals |bottom|
+  // then the queue is empty.
   unsigned top;
-  // bottom contains the index of the last error in the queue.
+  // bottom contains the index before the least recent error in the queue.
   unsigned bottom;
 
   // to_free, if not NULL, contains a pointer owned by this structure that was
@@ -192,8 +192,7 @@ static int global_next_library = ERR_NUM_LIBS;
 
 // global_next_library_mutex protects |global_next_library| from concurrent
 // updates.
-static struct CRYPTO_STATIC_MUTEX global_next_library_mutex =
-    CRYPTO_STATIC_MUTEX_INIT;
+static CRYPTO_MUTEX global_next_library_mutex = CRYPTO_MUTEX_INIT;
 
 static void err_state_free(void *statep) {
   ERR_STATE *state = statep;
@@ -367,9 +366,9 @@ void ERR_remove_thread_state(const CRYPTO_THREADID *tid) {
 int ERR_get_next_error_library(void) {
   int ret;
 
-  CRYPTO_STATIC_MUTEX_lock_write(&global_next_library_mutex);
+  CRYPTO_MUTEX_lock_write(&global_next_library_mutex);
   ret = global_next_library++;
-  CRYPTO_STATIC_MUTEX_unlock_write(&global_next_library_mutex);
+  CRYPTO_MUTEX_unlock_write(&global_next_library_mutex);
 
   return ret;
 }
@@ -867,6 +866,10 @@ void ERR_restore_state(const ERR_SAVE_STATE *state) {
     return;
   }
 
+  if (state->num_errors >= ERR_NUM_ERRORS) {
+    abort();
+  }
+
   ERR_STATE *const dst = err_get_state();
   if (dst == NULL) {
     return;
@@ -875,6 +878,6 @@ void ERR_restore_state(const ERR_SAVE_STATE *state) {
   for (size_t i = 0; i < state->num_errors; i++) {
     err_copy(&dst->errors[i], &state->errors[i]);
   }
-  dst->top = state->num_errors - 1;
+  dst->top = (unsigned)(state->num_errors - 1);
   dst->bottom = ERR_NUM_ERRORS - 1;
 }

data/third_party/boringssl-with-bazel/src/crypto/evp/evp.c

@@ -229,6 +229,13 @@ static const EVP_PKEY_ASN1_METHOD *evp_pkey_asn1_find(int nid) {
   }
 }
 
+static void evp_pkey_set_method(EVP_PKEY *pkey,
+                                const EVP_PKEY_ASN1_METHOD *method) {
+  free_it(pkey);
+  pkey->ameth = method;
+  pkey->type = pkey->ameth->pkey_id;
+}
+
 int EVP_PKEY_type(int nid) {
   const EVP_PKEY_ASN1_METHOD *meth = evp_pkey_asn1_find(nid);
   if (meth == NULL) {
@@ -246,7 +253,9 @@ int EVP_PKEY_set1_RSA(EVP_PKEY *pkey, RSA *key) {
 }
 
 int EVP_PKEY_assign_RSA(EVP_PKEY *pkey, RSA *key) {
-  return EVP_PKEY_assign(pkey, EVP_PKEY_RSA, key);
+  evp_pkey_set_method(pkey, &rsa_asn1_meth);
+  pkey->pkey = key;
+  return key != NULL;
 }
 
 RSA *EVP_PKEY_get0_RSA(const EVP_PKEY *pkey) {
@@ -274,7 +283,9 @@ int EVP_PKEY_set1_DSA(EVP_PKEY *pkey, DSA *key) {
 }
 
 int EVP_PKEY_assign_DSA(EVP_PKEY *pkey, DSA *key) {
-  return EVP_PKEY_assign(pkey, EVP_PKEY_DSA, key);
+  evp_pkey_set_method(pkey, &dsa_asn1_meth);
+  pkey->pkey = key;
+  return key != NULL;
 }
 
 DSA *EVP_PKEY_get0_DSA(const EVP_PKEY *pkey) {
@@ -302,7 +313,9 @@ int EVP_PKEY_set1_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) {
 }
 
 int EVP_PKEY_assign_EC_KEY(EVP_PKEY *pkey, EC_KEY *key) {
-  return EVP_PKEY_assign(pkey, EVP_PKEY_EC, key);
+  evp_pkey_set_method(pkey, &ec_asn1_meth);
+  pkey->pkey = key;
+  return key != NULL;
 }
 
 EC_KEY *EVP_PKEY_get0_EC_KEY(const EVP_PKEY *pkey) {
@@ -325,21 +338,32 @@ DH *EVP_PKEY_get0_DH(const EVP_PKEY *pkey) { return NULL; }
 DH *EVP_PKEY_get1_DH(const EVP_PKEY *pkey) { return NULL; }
 
 int EVP_PKEY_assign(EVP_PKEY *pkey, int type, void *key) {
-  if (!EVP_PKEY_set_type(pkey, type)) {
-    return 0;
+  // This function can only be used to assign RSA, DSA, and EC keys. Other key
+  // types have internal representations which are not exposed through the
+  // public API.
+  switch (type) {
+    case EVP_PKEY_RSA:
+      return EVP_PKEY_assign_RSA(pkey, key);
+    case EVP_PKEY_DSA:
+      return EVP_PKEY_assign_DSA(pkey, key);
+    case EVP_PKEY_EC:
+      return EVP_PKEY_assign_EC_KEY(pkey, key);
   }
-  pkey->pkey = key;
-  return key != NULL;
+
+  OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
+  ERR_add_error_dataf("algorithm %d", type);
+  return 0;
 }
 
 int EVP_PKEY_set_type(EVP_PKEY *pkey, int type) {
-  const EVP_PKEY_ASN1_METHOD *ameth;
-
   if (pkey && pkey->pkey) {
+    // This isn't strictly necessary, but historically |EVP_PKEY_set_type| would
+    // clear |pkey| even if |evp_pkey_asn1_find| failed, so we preserve that
+    // behavior.
     free_it(pkey);
   }
 
-  ameth = evp_pkey_asn1_find(type);
+  const EVP_PKEY_ASN1_METHOD *ameth = evp_pkey_asn1_find(type);
   if (ameth == NULL) {
     OPENSSL_PUT_ERROR(EVP, EVP_R_UNSUPPORTED_ALGORITHM);
     ERR_add_error_dataf("algorithm %d", type);
@@ -347,8 +371,7 @@ int EVP_PKEY_set_type(EVP_PKEY *pkey, int type) {
   }
 
   if (pkey) {
-    pkey->ameth = ameth;
-    pkey->type = pkey->ameth->pkey_id;
+    evp_pkey_set_method(pkey, ameth);
   }
 
   return 1;

data/third_party/boringssl-with-bazel/src/crypto/evp/p_ec.c

@@ -75,7 +75,7 @@
 typedef struct {
   // message digest
   const EVP_MD *md;
-  EC_GROUP *gen_group;
+  const EC_GROUP *gen_group;
 } EC_PKEY_CTX;
 
 
@@ -111,7 +111,6 @@ static void pkey_ec_cleanup(EVP_PKEY_CTX *ctx) {
     return;
   }
 
-  EC_GROUP_free(dctx->gen_group);
   OPENSSL_free(dctx);
 }
 
@@ -195,11 +194,10 @@ static int pkey_ec_ctrl(EVP_PKEY_CTX *ctx, int type, int p1, void *p2) {
       return 1;
 
     case EVP_PKEY_CTRL_EC_PARAMGEN_CURVE_NID: {
-      EC_GROUP *group = EC_GROUP_new_by_curve_name(p1);
+      const EC_GROUP *group = EC_GROUP_new_by_curve_name(p1);
       if (group == NULL) {
         return 0;
       }
-      EC_GROUP_free(dctx->gen_group);
       dctx->gen_group = group;
       return 1;
     }