grpc 1.60.0 → 1.62.0

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/cipher/e_aesccm.c

@@ -55,6 +55,7 @@
 #include <openssl/mem.h>
 
 #include "../delocate.h"
+#include "../modes/internal.h"
 #include "../service_indicator/internal.h"
 #include "internal.h"
 
@@ -66,10 +67,8 @@ struct ccm128_context {
 };
 
 struct ccm128_state {
-  union {
-    uint64_t u[2];
-    uint8_t c[16];
-  } nonce, cmac;
+  alignas(16) uint8_t nonce[16];
+  alignas(16) uint8_t cmac[16];
 };
 
 static int CRYPTO_ccm128_init(struct ccm128_context *ctx, const AES_KEY *key,
@@ -86,7 +85,7 @@ static int CRYPTO_ccm128_init(struct ccm128_context *ctx, const AES_KEY *key,
 }
 
 static size_t CRYPTO_ccm128_max_input(const struct ccm128_context *ctx) {
-  return ctx->L >= sizeof(size_t) ? (size_t)-1
+  return ctx->L >= sizeof(size_t) ? SIZE_MAX
                                   : (((size_t)1) << (ctx->L * 8)) - 1;
 }
 
@@ -107,16 +106,16 @@ static int ccm128_init_state(const struct ccm128_context *ctx,
 
   // Assemble the first block for computing the MAC.
   OPENSSL_memset(state, 0, sizeof(*state));
-  state->nonce.c[0] = (uint8_t)((L - 1) | ((M - 2) / 2) << 3);
+  state->nonce[0] = (uint8_t)((L - 1) | ((M - 2) / 2) << 3);
   if (aad_len != 0) {
-    state->nonce.c[0] |= 0x40;  // Set AAD Flag
+    state->nonce[0] |= 0x40;  // Set AAD Flag
   }
-  OPENSSL_memcpy(&state->nonce.c[1], nonce, nonce_len);
+  OPENSSL_memcpy(&state->nonce[1], nonce, nonce_len);
   for (unsigned i = 0; i < L; i++) {
-    state->nonce.c[15 - i] = (uint8_t)(plaintext_len >> (8 * i));
+    state->nonce[15 - i] = (uint8_t)(plaintext_len >> (8 * i));
   }
 
-  (*block)(state->nonce.c, state->cmac.c, key);
+  (*block)(state->nonce, state->cmac, key);
   size_t blocks = 1;
 
   if (aad_len != 0) {
@@ -124,38 +123,38 @@ static int ccm128_init_state(const struct ccm128_context *ctx,
     // Cast to u64 to avoid the compiler complaining about invalid shifts.
     uint64_t aad_len_u64 = aad_len;
     if (aad_len_u64 < 0x10000 - 0x100) {
-      state->cmac.c[0] ^= (uint8_t)(aad_len_u64 >> 8);
-      state->cmac.c[1] ^= (uint8_t)aad_len_u64;
+      state->cmac[0] ^= (uint8_t)(aad_len_u64 >> 8);
+      state->cmac[1] ^= (uint8_t)aad_len_u64;
       i = 2;
     } else if (aad_len_u64 <= 0xffffffff) {
-      state->cmac.c[0] ^= 0xff;
-      state->cmac.c[1] ^= 0xfe;
-      state->cmac.c[2] ^= (uint8_t)(aad_len_u64 >> 24);
-      state->cmac.c[3] ^= (uint8_t)(aad_len_u64 >> 16);
-      state->cmac.c[4] ^= (uint8_t)(aad_len_u64 >> 8);
-      state->cmac.c[5] ^= (uint8_t)aad_len_u64;
+      state->cmac[0] ^= 0xff;
+      state->cmac[1] ^= 0xfe;
+      state->cmac[2] ^= (uint8_t)(aad_len_u64 >> 24);
+      state->cmac[3] ^= (uint8_t)(aad_len_u64 >> 16);
+      state->cmac[4] ^= (uint8_t)(aad_len_u64 >> 8);
+      state->cmac[5] ^= (uint8_t)aad_len_u64;
       i = 6;
     } else {
-      state->cmac.c[0] ^= 0xff;
-      state->cmac.c[1] ^= 0xff;
-      state->cmac.c[2] ^= (uint8_t)(aad_len_u64 >> 56);
-      state->cmac.c[3] ^= (uint8_t)(aad_len_u64 >> 48);
-      state->cmac.c[4] ^= (uint8_t)(aad_len_u64 >> 40);
-      state->cmac.c[5] ^= (uint8_t)(aad_len_u64 >> 32);
-      state->cmac.c[6] ^= (uint8_t)(aad_len_u64 >> 24);
-      state->cmac.c[7] ^= (uint8_t)(aad_len_u64 >> 16);
-      state->cmac.c[8] ^= (uint8_t)(aad_len_u64 >> 8);
-      state->cmac.c[9] ^= (uint8_t)aad_len_u64;
+      state->cmac[0] ^= 0xff;
+      state->cmac[1] ^= 0xff;
+      state->cmac[2] ^= (uint8_t)(aad_len_u64 >> 56);
+      state->cmac[3] ^= (uint8_t)(aad_len_u64 >> 48);
+      state->cmac[4] ^= (uint8_t)(aad_len_u64 >> 40);
+      state->cmac[5] ^= (uint8_t)(aad_len_u64 >> 32);
+      state->cmac[6] ^= (uint8_t)(aad_len_u64 >> 24);
+      state->cmac[7] ^= (uint8_t)(aad_len_u64 >> 16);
+      state->cmac[8] ^= (uint8_t)(aad_len_u64 >> 8);
+      state->cmac[9] ^= (uint8_t)aad_len_u64;
       i = 10;
     }
 
     do {
       for (; i < 16 && aad_len != 0; i++) {
-        state->cmac.c[i] ^= *aad;
+        state->cmac[i] ^= *aad;
         aad++;
         aad_len--;
       }
-      (*block)(state->cmac.c, state->cmac.c, key);
+      (*block)(state->cmac, state->cmac, key);
       blocks++;
       i = 0;
     } while (aad_len != 0);
@@ -174,7 +173,7 @@ static int ccm128_init_state(const struct ccm128_context *ctx,
   // Assemble the first block for encrypting and decrypting. The bottom |L|
   // bytes are replaced with a counter and all bit the encoding of |L| is
   // cleared in the first byte.
-  state->nonce.c[0] &= 7;
+  state->nonce[0] &= 7;
   return 1;
 }
 
@@ -183,17 +182,17 @@ static int ccm128_encrypt(const struct ccm128_context *ctx,
                           uint8_t *out, const uint8_t *in, size_t len) {
   // The counter for encryption begins at one.
   for (unsigned i = 0; i < ctx->L; i++) {
-    state->nonce.c[15 - i] = 0;
+    state->nonce[15 - i] = 0;
   }
-  state->nonce.c[15] = 1;
+  state->nonce[15] = 1;
 
   uint8_t partial_buf[16];
   unsigned num = 0;
   if (ctx->ctr != NULL) {
-    CRYPTO_ctr128_encrypt_ctr32(in, out, len, key, state->nonce.c, partial_buf,
+    CRYPTO_ctr128_encrypt_ctr32(in, out, len, key, state->nonce, partial_buf,
                                 &num, ctx->ctr);
   } else {
-    CRYPTO_ctr128_encrypt(in, out, len, key, state->nonce.c, partial_buf, &num,
+    CRYPTO_ctr128_encrypt(in, out, len, key, state->nonce, partial_buf, &num,
                           ctx->block);
   }
   return 1;
@@ -209,34 +208,28 @@ static int ccm128_compute_mac(const struct ccm128_context *ctx,
   }
 
   // Incorporate |in| into the MAC.
-  union {
-    uint64_t u[2];
-    uint8_t c[16];
-  } tmp;
   while (len >= 16) {
-    OPENSSL_memcpy(tmp.c, in, 16);
-    state->cmac.u[0] ^= tmp.u[0];
-    state->cmac.u[1] ^= tmp.u[1];
-    (*block)(state->cmac.c, state->cmac.c, key);
+    CRYPTO_xor16(state->cmac, state->cmac, in);
+    (*block)(state->cmac, state->cmac, key);
     in += 16;
     len -= 16;
   }
   if (len > 0) {
     for (size_t i = 0; i < len; i++) {
-      state->cmac.c[i] ^= in[i];
+      state->cmac[i] ^= in[i];
     }
-    (*block)(state->cmac.c, state->cmac.c, key);
+    (*block)(state->cmac, state->cmac, key);
   }
 
   // Encrypt the MAC with counter zero.
   for (unsigned i = 0; i < ctx->L; i++) {
-    state->nonce.c[15 - i] = 0;
+    state->nonce[15 - i] = 0;
   }
-  (*block)(state->nonce.c, tmp.c, key);
-  state->cmac.u[0] ^= tmp.u[0];
-  state->cmac.u[1] ^= tmp.u[1];
+  alignas(16) uint8_t tmp[16];
+  (*block)(state->nonce, tmp, key);
+  CRYPTO_xor16(state->cmac, state->cmac, tmp);
 
-  OPENSSL_memcpy(out_tag, state->cmac.c, tag_len);
+  OPENSSL_memcpy(out_tag, state->cmac, tag_len);
   return 1;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/dh/dh.c

@@ -71,17 +71,13 @@
 
 
 DH *DH_new(void) {
-  DH *dh = OPENSSL_malloc(sizeof(DH));
+  DH *dh = OPENSSL_zalloc(sizeof(DH));
   if (dh == NULL) {
     return NULL;
   }
 
-  OPENSSL_memset(dh, 0, sizeof(DH));
-
   CRYPTO_MUTEX_init(&dh->method_mont_p_lock);
-
   dh->references = 1;
-
   return dh;
 }
 
@@ -398,7 +394,7 @@ int DH_compute_key(unsigned char *out, const BIGNUM *peers_key, DH *dh) {
 int DH_compute_key_hashed(DH *dh, uint8_t *out, size_t *out_len,
                           size_t max_out_len, const BIGNUM *peers_key,
                           const EVP_MD *digest) {
-  *out_len = (size_t)-1;
+  *out_len = SIZE_MAX;
 
   const size_t digest_len = EVP_MD_size(digest);
   if (digest_len > max_out_len) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/digest/digest.c

@@ -185,6 +185,10 @@ int EVP_MD_CTX_copy_ex(EVP_MD_CTX *out, const EVP_MD_CTX *in) {
 void EVP_MD_CTX_move(EVP_MD_CTX *out, EVP_MD_CTX *in) {
   EVP_MD_CTX_cleanup(out);
   // While not guaranteed, |EVP_MD_CTX| is currently safe to move with |memcpy|.
+  // bssl-crypto currently relies on this, however, so if we change this, we
+  // need to box the |HMAC_CTX|. (Relying on this is only fine because we assume
+  // BoringSSL and bssl-crypto will always be updated atomically. We do not
+  // allow any version skew between the two.)
   OPENSSL_memcpy(out, in, sizeof(EVP_MD_CTX));
   EVP_MD_CTX_init(in);
 }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/ec.c

@@ -250,11 +250,10 @@ EC_GROUP *EC_GROUP_new_curve_GFp(const BIGNUM *p, const BIGNUM *a,
     goto err;
   }
 
-  ret = OPENSSL_malloc(sizeof(EC_GROUP));
+  ret = OPENSSL_zalloc(sizeof(EC_GROUP));
   if (ret == NULL) {
     return NULL;
   }
-  OPENSSL_memset(ret, 0, sizeof(EC_GROUP));
   ret->references = 1;
   ret->meth = EC_GFp_mont_method();
   bn_mont_ctx_init(&ret->field);

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/ec_key.c

@@ -86,12 +86,11 @@
 DEFINE_STATIC_EX_DATA_CLASS(g_ec_ex_data_class)
 
 static EC_WRAPPED_SCALAR *ec_wrapped_scalar_new(const EC_GROUP *group) {
-  EC_WRAPPED_SCALAR *wrapped = OPENSSL_malloc(sizeof(EC_WRAPPED_SCALAR));
+  EC_WRAPPED_SCALAR *wrapped = OPENSSL_zalloc(sizeof(EC_WRAPPED_SCALAR));
   if (wrapped == NULL) {
     return NULL;
   }
 
-  OPENSSL_memset(wrapped, 0, sizeof(EC_WRAPPED_SCALAR));
   wrapped->bignum.d = wrapped->scalar.words;
   wrapped->bignum.width = group->order.N.width;
   wrapped->bignum.dmax = group->order.N.width;
@@ -106,13 +105,11 @@ static void ec_wrapped_scalar_free(EC_WRAPPED_SCALAR *scalar) {
 EC_KEY *EC_KEY_new(void) { return EC_KEY_new_method(NULL); }
 
 EC_KEY *EC_KEY_new_method(const ENGINE *engine) {
-  EC_KEY *ret = OPENSSL_malloc(sizeof(EC_KEY));
+  EC_KEY *ret = OPENSSL_zalloc(sizeof(EC_KEY));
   if (ret == NULL) {
     return NULL;
   }
 
-  OPENSSL_memset(ret, 0, sizeof(EC_KEY));
-
   if (engine) {
     ret->ecdsa_meth = ENGINE_get_ECDSA_method(engine);
   }
@@ -166,12 +163,12 @@ void EC_KEY_free(EC_KEY *r) {
     METHOD_unref(r->ecdsa_meth);
   }
 
+  CRYPTO_free_ex_data(g_ec_ex_data_class_bss_get(), r, &r->ex_data);
+
   EC_GROUP_free(r->group);
   EC_POINT_free(r->pub_key);
   ec_wrapped_scalar_free(r->priv_key);
 
-  CRYPTO_free_ex_data(g_ec_ex_data_class_bss_get(), r, &r->ex_data);
-
   OPENSSL_free(r);
 }
 
@@ -317,8 +314,10 @@ int EC_KEY_check_key(const EC_KEY *eckey) {
       OPENSSL_PUT_ERROR(EC, ERR_R_EC_LIB);
       return 0;
     }
-    if (!ec_GFp_simple_points_equal(eckey->group, &point,
-                                    &eckey->pub_key->raw)) {
+    // Leaking this comparison only leaks whether |eckey|'s public key was
+    // correct.
+    if (!constant_time_declassify_int(ec_GFp_simple_points_equal(
+            eckey->group, &point, &eckey->pub_key->raw))) {
       OPENSSL_PUT_ERROR(EC, EC_R_INVALID_PRIVATE_KEY);
       return 0;
     }
@@ -503,6 +502,14 @@ int EC_KEY_generate_key(EC_KEY *key) {
     return 0;
   }
 
+  // The public key is derived from the private key, but it is public.
+  //
+  // TODO(crbug.com/boringssl/677): This isn't quite right. While |pub_key|
+  // represents a public point, it is still in Jacobian form and the exact
+  // Jacobian representation is secret. We need to make it affine first. See
+  // discussion in the bug.
+  CONSTTIME_DECLASSIFY(&pub_key->raw, sizeof(pub_key->raw));
+
   ec_wrapped_scalar_free(key->priv_key);
   key->priv_key = priv_key;
   EC_POINT_free(key->pub_key);

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/p224-64.c

@@ -24,6 +24,7 @@
 #include <openssl/err.h>
 #include <openssl/mem.h>
 
+#include <assert.h>
 #include <string.h>
 
 #include "internal.h"
@@ -836,12 +837,12 @@ static void p224_select_point(const uint64_t idx, size_t size,
 
   for (size_t i = 0; i < size; i++) {
     const p224_limb *inlimbs = &pre_comp[i][0][0];
-    uint64_t mask = i ^ idx;
-    mask |= mask >> 4;
-    mask |= mask >> 2;
-    mask |= mask >> 1;
-    mask &= 1;
-    mask--;
+    static_assert(sizeof(uint64_t) <= sizeof(crypto_word_t),
+                  "crypto_word_t too small");
+    static_assert(sizeof(size_t) <= sizeof(crypto_word_t),
+                  "crypto_word_t too small");
+    // Without a value barrier, Clang adds a branch here.
+    uint64_t mask = value_barrier_w(constant_time_eq_w(i, idx));
     for (size_t j = 0; j < 4 * 3; j++) {
       outlimbs[j] |= inlimbs[j] & mask;
     }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/ec/wnaf.c

@@ -197,13 +197,8 @@ int ec_GFp_mont_mul_public_batch(const EC_GROUP *group, EC_JACOBIAN *r,
     wNAF = wNAF_stack;
     precomp = precomp_stack;
   } else {
-    if (num >= ((size_t)-1) / sizeof(wNAF_alloc[0]) ||
-        num >= ((size_t)-1) / sizeof(precomp_alloc[0])) {
-      OPENSSL_PUT_ERROR(EC, ERR_R_OVERFLOW);
-      goto err;
-    }
-    wNAF_alloc = OPENSSL_malloc(num * sizeof(wNAF_alloc[0]));
-    precomp_alloc = OPENSSL_malloc(num * sizeof(precomp_alloc[0]));
+    wNAF_alloc = OPENSSL_calloc(num, sizeof(wNAF_alloc[0]));
+    precomp_alloc = OPENSSL_calloc(num, sizeof(precomp_alloc[0]));
     if (wNAF_alloc == NULL || precomp_alloc == NULL) {
       goto err;
     }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/fork_detect.c

@@ -17,31 +17,34 @@
 #endif
 
 #include <openssl/base.h>
-
 #include "fork_detect.h"
 
-#if defined(OPENSSL_LINUX)
-#include <assert.h>
-#include <sys/mman.h>
+#if defined(OPENSSL_FORK_DETECTION_MADVISE)
 #include <unistd.h>
 #include <stdlib.h>
-
-#include "../delocate.h"
-#include "../../internal.h"
-
-
+#include <assert.h>
+#include <sys/mman.h>
 #if defined(MADV_WIPEONFORK)
 static_assert(MADV_WIPEONFORK == 18, "MADV_WIPEONFORK is not 18");
 #else
 #define MADV_WIPEONFORK 18
 #endif
+#elif defined(OPENSSL_FORK_DETECTION_PTHREAD_ATFORK)
+#include <unistd.h>
+#include <stdlib.h>
+#include <pthread.h>
+#endif // OPENSSL_FORK_DETECTION_MADVISE
 
+#include "../delocate.h"
+#include "../../internal.h"
+
+#if defined(OPENSSL_FORK_DETECTION_MADVISE)
+DEFINE_BSS_GET(int, g_force_madv_wipeonfork);
+DEFINE_BSS_GET(int, g_force_madv_wipeonfork_enabled);
 DEFINE_STATIC_ONCE(g_fork_detect_once);
 DEFINE_STATIC_MUTEX(g_fork_detect_lock);
 DEFINE_BSS_GET(CRYPTO_atomic_u32 *, g_fork_detect_addr);
 DEFINE_BSS_GET(uint64_t, g_fork_generation);
-DEFINE_BSS_GET(int, g_force_madv_wipeonfork);
-DEFINE_BSS_GET(int, g_force_madv_wipeonfork_enabled);
 
 static void init_fork_detect(void) {
   if (*g_force_madv_wipeonfork_bss_get()) {
@@ -73,9 +76,12 @@ static void init_fork_detect(void) {
   CRYPTO_atomic_store_u32(addr, 1);
   *g_fork_detect_addr_bss_get() = addr;
   *g_fork_generation_bss_get() = 1;
+
 }
 
 uint64_t CRYPTO_get_fork_generation(void) {
+  CRYPTO_once(g_fork_detect_once_bss_get(), init_fork_detect);
+
   // In a single-threaded process, there are obviously no races because there's
   // only a single mutator in the address space.
   //
@@ -87,7 +93,6 @@ uint64_t CRYPTO_get_fork_generation(void) {
   // child process is single-threaded, the child may become multi-threaded
   // before it observes this. Therefore, we must synchronize the logic below.
 
-  CRYPTO_once(g_fork_detect_once_bss_get(), init_fork_detect);
   CRYPTO_atomic_u32 *const flag_ptr = *g_fork_detect_addr_bss_get();
   if (flag_ptr == NULL) {
     // Our kernel is too old to support |MADV_WIPEONFORK| or
@@ -98,6 +103,12 @@ uint64_t CRYPTO_get_fork_generation(void) {
       // doesn't support it.
       return 42;
     }
+    // With Linux and clone(), we do not believe that pthread_atfork() is
+    // sufficient for detecting all forms of address space duplication. At this
+    // point we have a kernel that does not support MADV_WIPEONFORK. We could
+    // return the generation number from pthread_atfork() here and it would
+    // probably be safe in almost any situation, but to ensure safety we return
+    // 0 and force an entropy draw on every call.
     return 0;
   }
 
@@ -140,7 +151,34 @@ void CRYPTO_fork_detect_force_madv_wipeonfork_for_testing(int on) {
   *g_force_madv_wipeonfork_enabled_bss_get() = on;
 }
 
-#elif defined(OPENSSL_WINDOWS) || defined(OPENSSL_TRUSTY)
+#elif defined(OPENSSL_FORK_DETECTION_PTHREAD_ATFORK)
+
+DEFINE_STATIC_ONCE(g_pthread_fork_detection_once);
+DEFINE_BSS_GET(uint64_t, g_atfork_fork_generation);
+
+static void we_are_forked(void) {
+  // Immediately after a fork, the process must be single-threaded.
+  uint64_t value = *g_atfork_fork_generation_bss_get() + 1;
+  if (value == 0) {
+    value = 1;
+  }
+  *g_atfork_fork_generation_bss_get() = value;
+}
+
+static void init_pthread_fork_detection(void) {
+  if (pthread_atfork(NULL, NULL, we_are_forked) != 0) {
+    abort();
+  }
+  *g_atfork_fork_generation_bss_get() = 1;
+}
+
+uint64_t CRYPTO_get_fork_generation(void) {
+  CRYPTO_once(g_pthread_fork_detection_once_bss_get(), init_pthread_fork_detection);
+
+  return *g_atfork_fork_generation_bss_get();
+}
+
+#elif defined(OPENSSL_DOES_NOT_FORK)
 
 // These platforms are guaranteed not to fork, and therefore do not require
 // fork detection support. Returning a constant non zero value makes BoringSSL

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/fork_detect.h

@@ -17,6 +17,23 @@
 
 #include <openssl/base.h>
 
+#if defined(OPENSSL_LINUX)
+// On linux we use MADVISE instead of pthread_atfork(), due
+// to concerns about clone() being used for address space
+// duplication.
+#define OPENSSL_FORK_DETECTION
+#define OPENSSL_FORK_DETECTION_MADVISE
+#elif defined(OPENSSL_MACOS) || defined(OPENSSL_IOS) || \
+    defined(OPENSSL_OPENBSD) || defined(OPENSSL_FREEBSD)
+// These platforms may detect address space duplication with pthread_atfork.
+// iOS doesn't normally allow fork in apps, but it's there.
+#define OPENSSL_FORK_DETECTION
+#define OPENSSL_FORK_DETECTION_PTHREAD_ATFORK
+#elif defined(OPENSSL_WINDOWS) || defined(OPENSSL_TRUSTY)
+// These platforms do not fork.
+#define OPENSSL_DOES_NOT_FORK
+#endif
+
 #if defined(__cplusplus)
 extern "C" {
 #endif

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rand/rand.c

@@ -119,7 +119,10 @@ static void rand_thread_state_free(void *state_in) {
 
   if (state->prev != NULL) {
     state->prev->next = state->next;
-  } else {
+  } else if (*thread_states_list_bss_get() == state) {
+    // |state->prev| may be NULL either if it is the head of the list,
+    // or if |state| is freed before it was added to the list at all.
+    // Compare against the head of the list to distinguish these cases.
     *thread_states_list_bss_get() = state->next;
   }
 
@@ -371,7 +374,7 @@ void RAND_bytes_with_additional_data(uint8_t *out, size_t out_len,
       CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_RAND);
 
   if (state == NULL) {
-    state = OPENSSL_malloc(sizeof(struct rand_thread_state));
+    state = OPENSSL_zalloc(sizeof(struct rand_thread_state));
     if (state == NULL ||
         !CRYPTO_set_thread_local(OPENSSL_THREAD_LOCAL_RAND, state,
                                  rand_thread_state_free)) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/blinding.c

@@ -130,11 +130,10 @@ static int bn_blinding_create_param(BN_BLINDING *b, const BIGNUM *e,
                                     const BN_MONT_CTX *mont, BN_CTX *ctx);
 
 BN_BLINDING *BN_BLINDING_new(void) {
-  BN_BLINDING *ret = OPENSSL_malloc(sizeof(BN_BLINDING));
+  BN_BLINDING *ret = OPENSSL_zalloc(sizeof(BN_BLINDING));
   if (ret == NULL) {
     return NULL;
   }
-  OPENSSL_memset(ret, 0, sizeof(BN_BLINDING));
 
   ret->A = BN_new();
   if (ret->A == NULL) {

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/rsa.c

@@ -206,13 +206,11 @@ RSA *RSA_new_private_key_large_e(const BIGNUM *n, const BIGNUM *e,
 RSA *RSA_new(void) { return RSA_new_method(NULL); }
 
 RSA *RSA_new_method(const ENGINE *engine) {
-  RSA *rsa = OPENSSL_malloc(sizeof(RSA));
+  RSA *rsa = OPENSSL_zalloc(sizeof(RSA));
   if (rsa == NULL) {
     return NULL;
   }
 
-  OPENSSL_memset(rsa, 0, sizeof(RSA));
-
   if (engine) {
     rsa->meth = ENGINE_get_RSA_method(engine);
   }

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/rsa/rsa_impl.c

@@ -155,7 +155,7 @@ static int ensure_fixed_copy(BIGNUM **out, const BIGNUM *in, int width) {
     return 0;
   }
   *out = copy;
-  CONSTTIME_SECRET(copy->d, sizeof(BN_ULONG) * width);
+  bn_secret(copy);
 
   return 1;
 }
@@ -259,8 +259,7 @@ static int freeze_private_key(RSA *rsa, BN_CTX *ctx) {
           goto err;
         }
         rsa->iqmp_mont = iqmp_mont;
-        CONSTTIME_SECRET(rsa->iqmp_mont->d,
-                         sizeof(BN_ULONG) * rsa->iqmp_mont->width);
+        bn_secret(rsa->iqmp_mont);
       }
     }
   }
@@ -376,7 +375,7 @@ static BN_BLINDING *rsa_blinding_get(RSA *rsa, size_t *index_used,
   assert(new_num_blindings > rsa->num_blindings);
 
   BN_BLINDING **new_blindings =
-      OPENSSL_malloc(sizeof(BN_BLINDING *) * new_num_blindings);
+      OPENSSL_calloc(new_num_blindings, sizeof(BN_BLINDING *));
   uint8_t *new_blindings_inuse = OPENSSL_malloc(new_num_blindings);
   if (new_blindings == NULL || new_blindings_inuse == NULL) {
     goto err;
@@ -622,7 +621,9 @@ int rsa_default_private_transform(RSA *rsa, uint8_t *out, const uint8_t *in,
     goto err;
   }
 
-  if (BN_ucmp(f, rsa->n) >= 0) {
+  // The input to the RSA private transform may be secret, but padding is
+  // expected to construct a value within range, so we can leak this comparison.
+  if (constant_time_declassify_int(BN_ucmp(f, rsa->n) >= 0)) {
     // Usually the padding functions would catch this.
     OPENSSL_PUT_ERROR(RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS);
     goto err;

data/third_party/boringssl-with-bazel/src/crypto/fipsmodule/self_check/fips.c

@@ -94,12 +94,11 @@ void boringssl_fips_inc_counter(enum fips_counter_t counter) {
       CRYPTO_get_thread_local(OPENSSL_THREAD_LOCAL_FIPS_COUNTERS);
   if (!array) {
     const size_t num_bytes = sizeof(size_t) * (fips_counter_max + 1);
-    array = OPENSSL_malloc(num_bytes);
+    array = OPENSSL_zalloc(num_bytes);
     if (!array) {
       return;
     }
 
-    OPENSSL_memset(array, 0, num_bytes);
     if (!CRYPTO_set_thread_local(OPENSSL_THREAD_LOCAL_FIPS_COUNTERS, array,
                                  OPENSSL_free)) {
       // |OPENSSL_free| has already been called by |CRYPTO_set_thread_local|.