grpc 1.57.0 → 1.58.0

data/third_party/boringssl-with-bazel/src/crypto/bio/connect.c

@@ -233,7 +233,7 @@ static int conn_state(BIO *bio, BIO_CONNECT *c) {
         BIO_clear_retry_flags(bio);
         ret = connect(bio->num, (struct sockaddr*) &c->them, c->them_length);
         if (ret < 0) {
-          if (bio_fd_should_retry(ret)) {
+          if (bio_socket_should_retry(ret)) {
             BIO_set_flags(bio, (BIO_FLAGS_IO_SPECIAL | BIO_FLAGS_SHOULD_RETRY));
             c->state = BIO_CONN_S_BLOCKED_CONNECT;
             bio->retry_reason = BIO_RR_CONNECT;
@@ -252,7 +252,7 @@ static int conn_state(BIO *bio, BIO_CONNECT *c) {
       case BIO_CONN_S_BLOCKED_CONNECT:
         i = bio_sock_error(bio->num);
         if (i) {
-          if (bio_fd_should_retry(ret)) {
+          if (bio_socket_should_retry(ret)) {
             BIO_set_flags(bio, (BIO_FLAGS_IO_SPECIAL | BIO_FLAGS_SHOULD_RETRY));
             c->state = BIO_CONN_S_BLOCKED_CONNECT;
             bio->retry_reason = BIO_RR_CONNECT;
@@ -366,7 +366,7 @@ static int conn_read(BIO *bio, char *out, int out_len) {
   ret = (int)recv(bio->num, out, out_len, 0);
   BIO_clear_retry_flags(bio);
   if (ret <= 0) {
-    if (bio_fd_should_retry(ret)) {
+    if (bio_socket_should_retry(ret)) {
       BIO_set_retry_read(bio);
     }
   }
@@ -390,7 +390,7 @@ static int conn_write(BIO *bio, const char *in, int in_len) {
   ret = (int)send(bio->num, in, in_len, 0);
   BIO_clear_retry_flags(bio);
   if (ret <= 0) {
-    if (bio_fd_should_retry(ret)) {
+    if (bio_socket_should_retry(ret)) {
       BIO_set_retry_write(bio);
     }
   }
@@ -532,7 +532,7 @@ int BIO_set_conn_port(BIO *bio, const char *port_str) {
 
 int BIO_set_conn_int_port(BIO *bio, const int *port) {
   char buf[DECIMAL_SIZE(int) + 1];
-  BIO_snprintf(buf, sizeof(buf), "%d", *port);
+  snprintf(buf, sizeof(buf), "%d", *port);
   return BIO_set_conn_port(bio, buf);
 }
 

data/third_party/boringssl-with-bazel/src/crypto/bio/errno.c

@@ -0,0 +1,92 @@
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ *
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ *
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.] */
+
+#include <openssl/bio.h>
+
+#include <errno.h>
+
+#include "internal.h"
+
+
+int bio_errno_should_retry(int return_value) {
+  if (return_value != -1) {
+    return 0;
+  }
+
+  return
+#ifdef EWOULDBLOCK
+      errno == EWOULDBLOCK ||
+#endif
+#ifdef ENOTCONN
+      errno == ENOTCONN ||
+#endif
+#ifdef EINTR
+      errno == EINTR ||
+#endif
+#ifdef EAGAIN
+      errno == EAGAIN ||
+#endif
+#ifdef EPROTO
+      errno == EPROTO ||
+#endif
+#ifdef EINPROGRESS
+      errno == EINPROGRESS ||
+#endif
+#ifdef EALREADY
+      errno == EALREADY ||
+#endif
+      0;
+}

data/third_party/boringssl-with-bazel/src/crypto/bio/fd.c

@@ -65,9 +65,6 @@
 #include <unistd.h>
 #else
 #include <io.h>
-OPENSSL_MSVC_PRAGMA(warning(push, 3))
-#include <windows.h>
-OPENSSL_MSVC_PRAGMA(warning(pop))
 #endif
 
 #include <openssl/err.h>
@@ -77,59 +74,18 @@ OPENSSL_MSVC_PRAGMA(warning(pop))
 #include "../internal.h"
 
 
-static int bio_fd_non_fatal_error(int err) {
-  if (
-#ifdef EWOULDBLOCK
-    err == EWOULDBLOCK ||
-#endif
-#ifdef WSAEWOULDBLOCK
-    err == WSAEWOULDBLOCK ||
-#endif
-#ifdef ENOTCONN
-    err == ENOTCONN ||
-#endif
-#ifdef EINTR
-    err == EINTR ||
-#endif
-#ifdef EAGAIN
-    err == EAGAIN ||
-#endif
-#ifdef EPROTO
-    err == EPROTO ||
-#endif
-#ifdef EINPROGRESS
-    err == EINPROGRESS ||
-#endif
-#ifdef EALREADY
-    err == EALREADY ||
-#endif
-    0) {
-    return 1;
-  }
-  return 0;
-}
-
 #if defined(OPENSSL_WINDOWS)
-  #define BORINGSSL_ERRNO (int)GetLastError()
   #define BORINGSSL_CLOSE _close
   #define BORINGSSL_LSEEK _lseek
   #define BORINGSSL_READ _read
   #define BORINGSSL_WRITE _write
 #else
-  #define BORINGSSL_ERRNO errno
   #define BORINGSSL_CLOSE close
   #define BORINGSSL_LSEEK lseek
   #define BORINGSSL_READ read
   #define BORINGSSL_WRITE write
 #endif
 
-int bio_fd_should_retry(int i) {
-  if (i == -1) {
-    return bio_fd_non_fatal_error(BORINGSSL_ERRNO);
-  }
-  return 0;
-}
-
 BIO *BIO_new_fd(int fd, int close_flag) {
   BIO *ret = BIO_new(BIO_s_fd());
   if (ret == NULL) {
@@ -161,7 +117,7 @@ static int fd_read(BIO *b, char *out, int outl) {
   ret = (int)BORINGSSL_READ(b->num, out, outl);
   BIO_clear_retry_flags(b);
   if (ret <= 0) {
-    if (bio_fd_should_retry(ret)) {
+    if (bio_errno_should_retry(ret)) {
       BIO_set_retry_read(b);
     }
   }
@@ -173,7 +129,7 @@ static int fd_write(BIO *b, const char *in, int inl) {
   int ret = (int)BORINGSSL_WRITE(b->num, in, inl);
   BIO_clear_retry_flags(b);
   if (ret <= 0) {
-    if (bio_fd_should_retry(ret)) {
+    if (bio_errno_should_retry(ret)) {
       BIO_set_retry_write(b);
     }
   }
@@ -268,6 +224,8 @@ static const BIO_METHOD methods_fdp = {
 
 const BIO_METHOD *BIO_s_fd(void) { return &methods_fdp; }
 
+#endif  // OPENSSL_NO_POSIX_IO
+
 int BIO_set_fd(BIO *bio, int fd, int close_flag) {
   return (int)BIO_int_ctrl(bio, BIO_C_SET_FD, close_flag, fd);
 }
@@ -275,5 +233,3 @@ int BIO_set_fd(BIO *bio, int fd, int close_flag) {
 int BIO_get_fd(BIO *bio, int *out_fd) {
   return (int)BIO_ctrl(bio, BIO_C_GET_FD, 0, (char *) out_fd);
 }
-
-#endif  // OPENSSL_NO_POSIX_IO

data/third_party/boringssl-with-bazel/src/crypto/bio/file.c

@@ -73,8 +73,6 @@
 
 #include <openssl/bio.h>
 
-#if !defined(OPENSSL_TRUSTY)
-
 #include <errno.h>
 #include <stdio.h>
 #include <string.h>
@@ -89,11 +87,20 @@
 #define BIO_FP_WRITE 0x04
 #define BIO_FP_APPEND 0x08
 
+#if !defined(OPENSSL_NO_FILESYSTEM)
+#define fopen_if_available fopen
+#else
+static FILE *fopen_if_available(const char *path, const char *mode) {
+  errno = ENOENT;
+  return NULL;
+}
+#endif
+
 BIO *BIO_new_file(const char *filename, const char *mode) {
   BIO *ret;
   FILE *file;
 
-  file = fopen(filename, mode);
+  file = fopen_if_available(filename, mode);
   if (file == NULL) {
     OPENSSL_PUT_SYSTEM_ERROR();
 
@@ -214,7 +221,7 @@ static long file_ctrl(BIO *b, int cmd, long num, void *ptr) {
         ret = 0;
         break;
       }
-      fp = fopen(ptr, mode);
+      fp = fopen_if_available(ptr, mode);
       if (fp == NULL) {
         OPENSSL_PUT_SYSTEM_ERROR();
         ERR_add_error_data(5, "fopen('", ptr, "','", mode, "')");
@@ -310,5 +317,3 @@ long BIO_tell(BIO *bio) { return BIO_ctrl(bio, BIO_C_FILE_TELL, 0, NULL); }
 long BIO_seek(BIO *bio, long offset) {
   return BIO_ctrl(bio, BIO_C_FILE_SEEK, offset, NULL);
 }
-
-#endif  // OPENSSL_TRUSTY

data/third_party/boringssl-with-bazel/src/crypto/bio/internal.h

@@ -59,6 +59,7 @@
 
 #include <openssl/base.h>
 
+#if !defined(OPENSSL_NO_SOCK)
 #if !defined(OPENSSL_WINDOWS)
 #if defined(OPENSSL_PNACL)
 // newlib uses u_short in socket.h without defining it.
@@ -72,13 +73,16 @@ OPENSSL_MSVC_PRAGMA(warning(push, 3))
 OPENSSL_MSVC_PRAGMA(warning(pop))
 typedef int socklen_t;
 #endif
+#endif  // !OPENSSL_NO_SOCK
 
 #if defined(__cplusplus)
 extern "C" {
 #endif
 
 
-// BIO_ip_and_port_to_socket_and_addr creates a socket and fills in |*out_addr|
+#if !defined(OPENSSL_NO_SOCK)
+
+// bio_ip_and_port_to_socket_and_addr creates a socket and fills in |*out_addr|
 // and |*out_addr_length| with the correct values for connecting to |hostname|
 // on |port_str|. It returns one on success or zero on error.
 int bio_ip_and_port_to_socket_and_addr(int *out_sock,
@@ -87,21 +91,27 @@ int bio_ip_and_port_to_socket_and_addr(int *out_sock,
                                        const char *hostname,
                                        const char *port_str);
 
-// BIO_socket_nbio sets whether |sock| is non-blocking. It returns one on
+// bio_socket_nbio sets whether |sock| is non-blocking. It returns one on
 // success and zero otherwise.
 int bio_socket_nbio(int sock, int on);
 
-// BIO_clear_socket_error clears the last system socket error.
+// bio_clear_socket_error clears the last system socket error.
 //
 // TODO(fork): remove all callers of this.
 void bio_clear_socket_error(void);
 
-// BIO_sock_error returns the last socket error on |sock|.
+// bio_sock_error returns the last socket error on |sock|.
 int bio_sock_error(int sock);
 
-// BIO_fd_should_retry returns non-zero if |return_value| indicates an error
+// bio_socket_should_retry returns non-zero if |return_value| indicates an error
+// and the last socket error indicates that it's non-fatal.
+int bio_socket_should_retry(int return_value);
+
+#endif  // !OPENSSL_NO_SOCK
+
+// bio_errno_should_retry returns non-zero if |return_value| indicates an error
 // and |errno| indicates that it's non-fatal.
-int bio_fd_should_retry(int return_value);
+int bio_errno_should_retry(int return_value);
 
 
 #if defined(__cplusplus)

data/third_party/boringssl-with-bazel/src/crypto/bio/socket.c

@@ -104,7 +104,7 @@ static int sock_read(BIO *b, char *out, int outl) {
 #endif
   BIO_clear_retry_flags(b);
   if (ret <= 0) {
-    if (bio_fd_should_retry(ret)) {
+    if (bio_socket_should_retry(ret)) {
       BIO_set_retry_read(b);
     }
   }
@@ -120,7 +120,7 @@ static int sock_write(BIO *b, const char *in, int inl) {
 #endif
   BIO_clear_retry_flags(b);
   if (ret <= 0) {
-    if (bio_fd_should_retry(ret)) {
+    if (bio_socket_should_retry(ret)) {
       BIO_set_retry_write(b);
     }
   }

data/third_party/boringssl-with-bazel/src/crypto/bio/socket_helper.c

@@ -121,4 +121,13 @@ int bio_sock_error(int sock) {
   return error;
 }
 
+int bio_socket_should_retry(int return_value) {
+#if defined(OPENSSL_WINDOWS)
+  return return_value == -1 && WSAGetLastError() == WSAEWOULDBLOCK;
+#else
+  // On POSIX platforms, sockets and fds are the same.
+  return bio_errno_should_retry(return_value);
+#endif
+}
+
 #endif  // OPENSSL_NO_SOCK

data/third_party/boringssl-with-bazel/src/crypto/bytestring/cbs.c

@@ -694,7 +694,7 @@ int CBS_is_unsigned_asn1_integer(const CBS *cbs) {
 
 static int add_decimal(CBB *out, uint64_t v) {
   char buf[DECIMAL_SIZE(uint64_t) + 1];
-  BIO_snprintf(buf, sizeof(buf), "%" PRIu64, v);
+  snprintf(buf, sizeof(buf), "%" PRIu64, v);
   return CBB_add_bytes(out, (const uint8_t *)buf, strlen(buf));
 }
 

data/third_party/boringssl-with-bazel/src/crypto/conf/conf.c

@@ -387,7 +387,7 @@ static void clear_comments(CONF *conf, char *p) {
   }
 }
 
-static int def_load_bio(CONF *conf, BIO *in, long *out_error_line) {
+int NCONF_load_bio(CONF *conf, BIO *in, long *out_error_line) {
   static const size_t CONFBUFSIZE = 512;
   int bufnum = 0, i, ii;
   BUF_MEM *buff = NULL;
@@ -574,7 +574,7 @@ err:
   if (out_error_line != NULL) {
     *out_error_line = eline;
   }
-  BIO_snprintf(btmp, sizeof btmp, "%ld", eline);
+  snprintf(btmp, sizeof btmp, "%ld", eline);
   ERR_add_error_data(2, "line ", btmp);
 
   if (v != NULL) {
@@ -594,16 +594,12 @@ int NCONF_load(CONF *conf, const char *filename, long *out_error_line) {
     return 0;
   }
 
-  ret = def_load_bio(conf, in, out_error_line);
+  ret = NCONF_load_bio(conf, in, out_error_line);
   BIO_free(in);
 
   return ret;
 }
 
-int NCONF_load_bio(CONF *conf, BIO *bio, long *out_error_line) {
-  return def_load_bio(conf, bio, out_error_line);
-}
-
 int CONF_parse_list(const char *list, char sep, int remove_whitespace,
                     int (*list_cb)(const char *elem, size_t len, void *usr),
                     void *arg) {

data/third_party/boringssl-with-bazel/src/crypto/cpu_aarch64_apple.c

@@ -23,8 +23,6 @@
 #include <openssl/arm_arch.h>
 
 
-extern uint32_t OPENSSL_armcap_P;
-
 static int has_hw_feature(const char *name) {
   int value;
   size_t len = sizeof(value);

data/third_party/boringssl-with-bazel/src/crypto/cpu_aarch64_fuchsia.c

@@ -23,7 +23,6 @@
 
 #include <openssl/arm_arch.h>
 
-extern uint32_t OPENSSL_armcap_P;
 
 void OPENSSL_cpuid_setup(void) {
   uint32_t hwcap;

data/third_party/boringssl-with-bazel/src/crypto/cpu_aarch64_linux.c

@@ -22,8 +22,6 @@
 #include <openssl/arm_arch.h>
 
 
-extern uint32_t OPENSSL_armcap_P;
-
 void OPENSSL_cpuid_setup(void) {
   unsigned long hwcap = getauxval(AT_HWCAP);
 

data/third_party/boringssl-with-bazel/src/crypto/cpu_aarch64_openbsd.c

@@ -25,7 +25,6 @@
 
 #include "internal.h"
 
-extern uint32_t OPENSSL_armcap_P;
 
 void OPENSSL_cpuid_setup(void) {
   int isar0_mib[] = { CTL_MACHDEP, CPU_ID_AA64ISAR0 };

data/third_party/boringssl-with-bazel/src/crypto/cpu_aarch64_sysreg.c

@@ -0,0 +1,93 @@
+/* Copyright (c) 2023, Google Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
+ * SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
+ * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
+ * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
+
+#include "internal.h"
+
+// While Arm system registers are normally not available to userspace, FreeBSD
+// expects userspace to simply read them. It traps the reads and fills in CPU
+// capabilities.
+#if defined(OPENSSL_AARCH64) && !defined(OPENSSL_STATIC_ARMCAP) && \
+    (defined(ANDROID_BAREMETAL) || defined(OPENSSL_FREEBSD))
+
+#include <openssl/arm_arch.h>
+
+#define ID_AA64PFR0_EL1_ADVSIMD 5
+
+#define ID_AA64ISAR0_EL1_AES 1
+#define ID_AA64ISAR0_EL1_SHA1 2
+#define ID_AA64ISAR0_EL1_SHA2 3
+
+#define NBITS_ID_FIELD 4
+
+#define READ_SYSREG(name)                \
+  ({                                     \
+    uint64_t _r;                         \
+    __asm__("mrs %0, " name : "=r"(_r)); \
+    _r;                                  \
+  })
+
+static unsigned get_id_field(uint64_t reg, unsigned field) {
+  return (reg >> (field * NBITS_ID_FIELD)) & ((1 << NBITS_ID_FIELD) - 1);
+}
+
+static int get_signed_id_field(uint64_t reg, unsigned field) {
+  unsigned value = get_id_field(reg, field);
+  if (value & (1 << (NBITS_ID_FIELD - 1))) {
+    return (int)(value | (UINT64_MAX << NBITS_ID_FIELD));
+  } else {
+    return (int)value;
+  }
+}
+
+static uint32_t read_armcap(void) {
+  uint32_t armcap = ARMV7_NEON;
+
+  uint64_t id_aa64pfr0_el1 = READ_SYSREG("id_aa64pfr0_el1");
+
+  if (get_signed_id_field(id_aa64pfr0_el1, ID_AA64PFR0_EL1_ADVSIMD) < 0) {
+    // If AdvSIMD ("NEON") is missing, don't report other features either.
+    // This matches OpenSSL.
+    return 0;
+  }
+
+  uint64_t id_aa64isar0_el1 = READ_SYSREG("id_aa64isar0_el1");
+
+  unsigned aes = get_id_field(id_aa64isar0_el1, ID_AA64ISAR0_EL1_AES);
+  if (aes > 0) {
+    armcap |= ARMV8_AES;
+  }
+  if (aes > 1) {
+    armcap |= ARMV8_PMULL;
+  }
+
+  unsigned sha1 = get_id_field(id_aa64isar0_el1, ID_AA64ISAR0_EL1_SHA1);
+  if (sha1 > 0) {
+    armcap |= ARMV8_SHA1;
+  }
+
+  unsigned sha2 = get_id_field(id_aa64isar0_el1, ID_AA64ISAR0_EL1_SHA2);
+  if (sha2 > 0) {
+    armcap |= ARMV8_SHA256;
+  }
+  if (sha2 > 1) {
+    armcap |= ARMV8_SHA512;
+  }
+
+  return armcap;
+}
+
+void OPENSSL_cpuid_setup(void) { OPENSSL_armcap_P |= read_armcap(); }
+
+#endif  // OPENSSL_AARCH64 && !OPENSSL_STATIC_ARMCAP &&
+        // (ANDROID_BAREMETAL || OPENSSL_FREEBSD)

data/third_party/boringssl-with-bazel/src/crypto/cpu_aarch64_win.c

@@ -22,7 +22,7 @@
 
 #include <openssl/arm_arch.h>
 
-extern uint32_t OPENSSL_armcap_P;
+
 void OPENSSL_cpuid_setup(void) {
   // We do not need to check for the presence of NEON, as Armv8-A always has it
   OPENSSL_armcap_P |= ARMV7_NEON;

data/third_party/boringssl-with-bazel/src/crypto/cpu_arm_freebsd.c

@@ -22,7 +22,6 @@
 #include <openssl/arm_arch.h>
 #include <openssl/mem.h>
 
-extern uint32_t OPENSSL_armcap_P;
 
 void OPENSSL_cpuid_setup(void) {
   unsigned long hwcap = 0, hwcap2 = 0;

data/third_party/boringssl-with-bazel/src/crypto/cpu_arm_linux.c

@@ -95,8 +95,6 @@ err:
   return ret;
 }
 
-extern uint32_t OPENSSL_armcap_P;
-
 static int g_needs_hwcap2_workaround;
 
 void OPENSSL_cpuid_setup(void) {

data/third_party/boringssl-with-bazel/src/crypto/dh_extra/dh_asn1.c

@@ -110,6 +110,10 @@ DH *DH_parse_parameters(CBS *cbs) {
     goto err;
   }
 
+  if (!dh_check_params_fast(ret)) {
+    goto err;
+  }
+
   return ret;
 
 err:

data/third_party/boringssl-with-bazel/src/crypto/dh_extra/params.c

@@ -337,6 +337,11 @@ int DH_generate_parameters_ex(DH *dh, int prime_bits, int generator,
   // It's just as OK (and in some sense better) to use a generator of the
   // order-q subgroup.
 
+  if (prime_bits <= 0 || prime_bits > OPENSSL_DH_MAX_MODULUS_BITS) {
+    OPENSSL_PUT_ERROR(DH, DH_R_MODULUS_TOO_LARGE);
+    return 0;
+  }
+
   BIGNUM *t1, *t2;
   int g, ok = 0;
   BN_CTX *ctx = NULL;