grpc 1.61.0 → 1.62.0.pre1

data/third_party/boringssl-with-bazel/src/crypto/{kyber → keccak}/keccak.c

@@ -56,19 +56,40 @@ static void keccak_f(uint64_t state[25]) {
     // and the sequence will repeat. All that remains is to handle the element
     // at (0, 0), but the rotation for that element is zero, and it goes to (0,
     // 0), so we can ignore it.
-    static const uint8_t kIndexes[24] = {10, 7,  11, 17, 18, 3,  5,  16,
-                                         8,  21, 24, 4,  15, 23, 19, 13,
-                                         12, 2,  20, 14, 22, 9,  6,  1};
-    static const uint8_t kRotations[24] = {1,  3,  6,  10, 15, 21, 28, 36,
-                                           45, 55, 2,  14, 27, 41, 56, 8,
-                                           25, 43, 62, 18, 39, 61, 20, 44};
     uint64_t prev_value = state[1];
-    for (int i = 0; i < 24; i++) {
-      const uint64_t value = CRYPTO_rotl_u64(prev_value, kRotations[i]);
-      const size_t index = kIndexes[i];
-      prev_value = state[index];
-      state[index] = value;
-    }
+#define PI_RHO_STEP(index, rotation)                              \
+  do {                                                            \
+    const uint64_t value = CRYPTO_rotl_u64(prev_value, rotation); \
+    prev_value = state[index];                                    \
+    state[index] = value;                                         \
+  } while (0)
+
+    PI_RHO_STEP(10, 1);
+    PI_RHO_STEP(7, 3);
+    PI_RHO_STEP(11, 6);
+    PI_RHO_STEP(17, 10);
+    PI_RHO_STEP(18, 15);
+    PI_RHO_STEP(3, 21);
+    PI_RHO_STEP(5, 28);
+    PI_RHO_STEP(16, 36);
+    PI_RHO_STEP(8, 45);
+    PI_RHO_STEP(21, 55);
+    PI_RHO_STEP(24, 2);
+    PI_RHO_STEP(4, 14);
+    PI_RHO_STEP(15, 27);
+    PI_RHO_STEP(23, 41);
+    PI_RHO_STEP(19, 56);
+    PI_RHO_STEP(13, 8);
+    PI_RHO_STEP(12, 25);
+    PI_RHO_STEP(2, 43);
+    PI_RHO_STEP(20, 62);
+    PI_RHO_STEP(14, 18);
+    PI_RHO_STEP(22, 39);
+    PI_RHO_STEP(9, 61);
+    PI_RHO_STEP(6, 20);
+    PI_RHO_STEP(1, 44);
+
+#undef PI_RHO_STEP
 
     // χ step
     for (int y = 0; y < 5; y++) {
@@ -105,40 +126,90 @@ static void keccak_f(uint64_t state[25]) {
 }
 
 static void keccak_init(struct BORINGSSL_keccak_st *ctx,
-                        size_t *out_required_out_len, const uint8_t *in,
-                        size_t in_len, enum boringssl_keccak_config_t config) {
+                        size_t *out_required_out_len,
+                        enum boringssl_keccak_config_t config) {
   size_t capacity_bytes;
-  uint8_t terminator;
   switch (config) {
     case boringssl_sha3_256:
       capacity_bytes = 512 / 8;
       *out_required_out_len = 32;
-      terminator = 0x06;
       break;
     case boringssl_sha3_512:
       capacity_bytes = 1024 / 8;
       *out_required_out_len = 64;
-      terminator = 0x06;
       break;
     case boringssl_shake128:
       capacity_bytes = 256 / 8;
       *out_required_out_len = 0;
-      terminator = 0x1f;
       break;
     case boringssl_shake256:
       capacity_bytes = 512 / 8;
       *out_required_out_len = 0;
-      terminator = 0x1f;
       break;
     default:
       abort();
   }
 
   OPENSSL_memset(ctx, 0, sizeof(*ctx));
+  ctx->config = config;
+  ctx->phase = boringssl_keccak_phase_absorb;
   ctx->rate_bytes = 200 - capacity_bytes;
   assert(ctx->rate_bytes % 8 == 0);
+}
+
+void BORINGSSL_keccak(uint8_t *out, size_t out_len, const uint8_t *in,
+                      size_t in_len, enum boringssl_keccak_config_t config) {
+  struct BORINGSSL_keccak_st ctx;
+  size_t required_out_len;
+  keccak_init(&ctx, &required_out_len, config);
+  if (required_out_len != 0 && out_len != required_out_len) {
+    abort();
+  }
+  BORINGSSL_keccak_absorb(&ctx, in, in_len);
+  BORINGSSL_keccak_squeeze(&ctx, out, out_len);
+}
+
+void BORINGSSL_keccak_init(struct BORINGSSL_keccak_st *ctx,
+                           enum boringssl_keccak_config_t config) {
+  size_t required_out_len;
+  keccak_init(ctx, &required_out_len, config);
+  if (required_out_len != 0) {
+    abort();
+  }
+}
+
+void BORINGSSL_keccak_absorb(struct BORINGSSL_keccak_st *ctx, const uint8_t *in,
+                             size_t in_len) {
+  if (ctx->phase == boringssl_keccak_phase_squeeze) {
+    // It's illegal to call absorb() again after calling squeeze().
+    abort();
+  }
+
   const size_t rate_words = ctx->rate_bytes / 8;
+  // XOR the input. Accessing |ctx->state| as a |uint8_t*| is allowed by strict
+  // aliasing because we require |uint8_t| to be a character type.
+  uint8_t *state_bytes = (uint8_t *)ctx->state;
+
+  // Absorb partial block.
+  if (ctx->absorb_offset != 0) {
+    assert(ctx->absorb_offset < ctx->rate_bytes);
+    size_t first_block_len = ctx->rate_bytes - ctx->absorb_offset;
+    for (size_t i = 0; i < first_block_len && i < in_len; i++) {
+      state_bytes[ctx->absorb_offset + i] ^= in[i];
+    }
+
+    // This input didn't fill the block.
+    if (first_block_len > in_len) {
+      ctx->absorb_offset += in_len;
+      return;
+    }
 
+    keccak_f(ctx->state);
+    in += first_block_len;
+    in_len -= first_block_len;
+  }
+
+  // Absorb full blocks.
   while (in_len >= ctx->rate_bytes) {
     for (size_t i = 0; i < rate_words; i++) {
       ctx->state[i] ^= CRYPTO_load_u64_le(in + 8 * i);
@@ -148,57 +219,61 @@ static void keccak_init(struct BORINGSSL_keccak_st *ctx,
     in_len -= ctx->rate_bytes;
   }
 
-  // XOR the final block. Accessing |ctx->state| as a |uint8_t*| is allowed by
-  // strict aliasing because we require |uint8_t| to be a character type.
-  uint8_t *state_bytes = (uint8_t *)ctx->state;
+  // Absorb partial block.
   assert(in_len < ctx->rate_bytes);
   for (size_t i = 0; i < in_len; i++) {
     state_bytes[i] ^= in[i];
   }
-  state_bytes[in_len] ^= terminator;
-  state_bytes[ctx->rate_bytes - 1] ^= 0x80;
-  keccak_f(ctx->state);
+  ctx->absorb_offset = in_len;
 }
 
-void BORINGSSL_keccak(uint8_t *out, size_t out_len, const uint8_t *in,
-                      size_t in_len, enum boringssl_keccak_config_t config) {
-  struct BORINGSSL_keccak_st ctx;
-  size_t required_out_len;
-  keccak_init(&ctx, &required_out_len, in, in_len, config);
-  if (required_out_len != 0 && out_len != required_out_len) {
-    abort();
+static void keccak_finalize(struct BORINGSSL_keccak_st *ctx) {
+  uint8_t terminator;
+  switch (ctx->config) {
+    case boringssl_sha3_256:
+    case boringssl_sha3_512:
+      terminator = 0x06;
+      break;
+    case boringssl_shake128:
+    case boringssl_shake256:
+      terminator = 0x1f;
+      break;
+    default:
+      abort();
   }
-  BORINGSSL_keccak_squeeze(&ctx, out, out_len);
-}
 
-void BORINGSSL_keccak_init(struct BORINGSSL_keccak_st *ctx, const uint8_t *in,
-                           size_t in_len,
-                           enum boringssl_keccak_config_t config) {
-  size_t required_out_len;
-  keccak_init(ctx, &required_out_len, in, in_len, config);
-  if (required_out_len != 0) {
-    abort();
-  }
+  // XOR the terminator. Accessing |ctx->state| as a |uint8_t*| is allowed by
+  // strict aliasing because we require |uint8_t| to be a character type.
+  uint8_t *state_bytes = (uint8_t *)ctx->state;
+  state_bytes[ctx->absorb_offset] ^= terminator;
+  state_bytes[ctx->rate_bytes - 1] ^= 0x80;
+  keccak_f(ctx->state);
 }
 
 void BORINGSSL_keccak_squeeze(struct BORINGSSL_keccak_st *ctx, uint8_t *out,
                               size_t out_len) {
+  if (ctx->phase == boringssl_keccak_phase_absorb) {
+    keccak_finalize(ctx);
+    ctx->phase = boringssl_keccak_phase_squeeze;
+  }
+
   // Accessing |ctx->state| as a |uint8_t*| is allowed by strict aliasing
   // because we require |uint8_t| to be a character type.
   const uint8_t *state_bytes = (const uint8_t *)ctx->state;
   while (out_len) {
-    size_t remaining = ctx->rate_bytes - ctx->offset;
+    if (ctx->squeeze_offset == ctx->rate_bytes) {
+      keccak_f(ctx->state);
+      ctx->squeeze_offset = 0;
+    }
+
+    size_t remaining = ctx->rate_bytes - ctx->squeeze_offset;
     size_t todo = out_len;
     if (todo > remaining) {
       todo = remaining;
     }
-    OPENSSL_memcpy(out, &state_bytes[ctx->offset], todo);
+    OPENSSL_memcpy(out, &state_bytes[ctx->squeeze_offset], todo);
     out += todo;
     out_len -= todo;
-    ctx->offset += todo;
-    if (ctx->offset == ctx->rate_bytes) {
-      keccak_f(ctx->state);
-      ctx->offset = 0;
-    }
+    ctx->squeeze_offset += todo;
   }
 }

data/third_party/boringssl-with-bazel/src/crypto/kyber/internal.h

@@ -32,37 +32,6 @@ extern "C" {
 // necessary to generate a key.
 #define KYBER_GENERATE_KEY_ENTROPY 64
 
-struct BORINGSSL_keccak_st {
-  uint64_t state[25];
-  size_t rate_bytes;
-  size_t offset;
-};
-
-enum boringssl_keccak_config_t {
-  boringssl_sha3_256,
-  boringssl_sha3_512,
-  boringssl_shake128,
-  boringssl_shake256,
-};
-
-// BORINGSSL_keccak hashes |in_len| bytes from |in| and writes |out_len| bytes
-// of output to |out|. If the |config| specifies a fixed-output function, like
-// SHA3-256, then |out_len| must be the correct length for that function.
-OPENSSL_EXPORT void BORINGSSL_keccak(uint8_t *out, size_t out_len,
-                                     const uint8_t *in, size_t in_len,
-                                     enum boringssl_keccak_config_t config);
-
-// BORINGSSL_keccak_init absorbs |in_len| bytes from |in| and sets up |ctx| for
-// squeezing. The |config| must specify a SHAKE variant, otherwise callers
-// should use |BORINGSSL_keccak|.
-OPENSSL_EXPORT void BORINGSSL_keccak_init(
-    struct BORINGSSL_keccak_st *ctx, const uint8_t *in, size_t in_len,
-    enum boringssl_keccak_config_t config);
-
-// BORINGSSL_keccak_squeeze writes |out_len| bytes to |out| from |ctx|.
-OPENSSL_EXPORT void BORINGSSL_keccak_squeeze(struct BORINGSSL_keccak_st *ctx,
-                                             uint8_t *out, size_t out_len);
-
 // KYBER_generate_key_external_entropy is a deterministic function to create a
 // pair of Kyber768 keys, using the supplied entropy. The entropy needs to be
 // uniformly random generated. This function is should only be used for tests,
@@ -73,15 +42,15 @@ OPENSSL_EXPORT void KYBER_generate_key_external_entropy(
     struct KYBER_private_key *out_private_key,
     const uint8_t entropy[KYBER_GENERATE_KEY_ENTROPY]);
 
-// KYBER_encap_external_entropy is a deterministic function to encapsulate
-// |out_shared_secret_len| bytes of |out_shared_secret| to |ciphertext|, using
-// |KYBER_ENCAP_ENTROPY| bytes of |entropy| for randomization. The
-// decapsulating side will be able to recover |entropy| in full. This
-// function is should only be used for tests, regular callers should use the
-// non-deterministic |KYBER_encap| directly.
+// KYBER_encap_external_entropy behaves like |KYBER_encap|, but uses
+// |KYBER_ENCAP_ENTROPY| bytes of |entropy| for randomization. The decapsulating
+// side will be able to recover |entropy| in full. This function should only be
+// used for tests, regular callers should use the non-deterministic
+// |KYBER_encap| directly.
 OPENSSL_EXPORT void KYBER_encap_external_entropy(
-    uint8_t out_ciphertext[KYBER_CIPHERTEXT_BYTES], uint8_t *out_shared_secret,
-    size_t out_shared_secret_len, const struct KYBER_public_key *public_key,
+    uint8_t out_ciphertext[KYBER_CIPHERTEXT_BYTES],
+    uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
+    const struct KYBER_public_key *public_key,
     const uint8_t entropy[KYBER_ENCAP_ENTROPY]);
 
 #if defined(__cplusplus)

data/third_party/boringssl-with-bazel/src/crypto/kyber/kyber.c

@@ -21,12 +21,29 @@
 #include <openssl/rand.h>
 
 #include "../internal.h"
+#include "../keccak/internal.h"
 #include "./internal.h"
 
 
 // See
 // https://pq-crystals.org/kyber/data/kyber-specification-round3-20210804.pdf
 
+static void prf(uint8_t *out, size_t out_len, const uint8_t in[33]) {
+  BORINGSSL_keccak(out, out_len, in, 33, boringssl_shake256);
+}
+
+static void hash_h(uint8_t out[32], const uint8_t *in, size_t len) {
+  BORINGSSL_keccak(out, 32, in, len, boringssl_sha3_256);
+}
+
+static void hash_g(uint8_t out[64], const uint8_t *in, size_t len) {
+  BORINGSSL_keccak(out, 64, in, len, boringssl_sha3_512);
+}
+
+static void kdf(uint8_t *out, size_t out_len, const uint8_t *in, size_t len) {
+  BORINGSSL_keccak(out, out_len, in, len, boringssl_shake256);
+}
+
 #define DEGREE 256
 #define RANK 3
 
@@ -283,7 +300,7 @@ static void scalar_inner_product(scalar *out, const vector *lhs,
 // operates on public inputs.
 static void scalar_from_keccak_vartime(scalar *out,
                                        struct BORINGSSL_keccak_st *keccak_ctx) {
-  assert(keccak_ctx->offset == 0);
+  assert(keccak_ctx->squeeze_offset == 0);
   assert(keccak_ctx->rate_bytes == 168);
   static_assert(168 % 3 == 0, "block and coefficient boundaries do not align");
 
@@ -314,7 +331,7 @@ static void scalar_centered_binomial_distribution_eta_2_with_prf(
     scalar *out, const uint8_t input[33]) {
   uint8_t entropy[128];
   static_assert(sizeof(entropy) == 2 * /*kEta=*/2 * DEGREE / 8, "");
-  BORINGSSL_keccak(entropy, sizeof(entropy), input, 33, boringssl_shake256);
+  prf(entropy, sizeof(entropy), input);
 
   for (int i = 0; i < DEGREE; i += 2) {
     uint8_t byte = entropy[i / 2];
@@ -354,8 +371,8 @@ static void matrix_expand(matrix *out, const uint8_t rho[32]) {
       input[32] = i;
       input[33] = j;
       struct BORINGSSL_keccak_st keccak_ctx;
-      BORINGSSL_keccak_init(&keccak_ctx, input, sizeof(input),
-                            boringssl_shake128);
+      BORINGSSL_keccak_init(&keccak_ctx, boringssl_shake128);
+      BORINGSSL_keccak_absorb(&keccak_ctx, input, sizeof(input));
       scalar_from_keccak_vartime(&out->v[i][j], &keccak_ctx);
     }
   }
@@ -610,7 +627,7 @@ void KYBER_generate_key_external_entropy(
     const uint8_t entropy[KYBER_GENERATE_KEY_ENTROPY]) {
   struct private_key *priv = private_key_from_external(out_private_key);
   uint8_t hashed[64];
-  BORINGSSL_keccak(hashed, sizeof(hashed), entropy, 32, boringssl_sha3_512);
+  hash_g(hashed, entropy, 32);
   const uint8_t *const rho = hashed;
   const uint8_t *const sigma = hashed + 32;
   OPENSSL_memcpy(priv->pub.rho, hashed, sizeof(priv->pub.rho));
@@ -630,9 +647,8 @@ void KYBER_generate_key_external_entropy(
     abort();
   }
 
-  BORINGSSL_keccak(priv->pub.public_key_hash, sizeof(priv->pub.public_key_hash),
-                   out_encoded_public_key, KYBER_PUBLIC_KEY_BYTES,
-                   boringssl_sha3_256);
+  hash_h(priv->pub.public_key_hash, out_encoded_public_key,
+         KYBER_PUBLIC_KEY_BYTES);
   OPENSSL_memcpy(priv->fo_failure_secret, entropy + 32, 32);
 }
 
@@ -681,12 +697,12 @@ static void encrypt_cpa(uint8_t out[KYBER_CIPHERTEXT_BYTES],
 
 // Calls KYBER_encap_external_entropy| with random bytes from |RAND_bytes|
 void KYBER_encap(uint8_t out_ciphertext[KYBER_CIPHERTEXT_BYTES],
-                 uint8_t *out_shared_secret, size_t out_shared_secret_len,
+                 uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
                  const struct KYBER_public_key *public_key) {
   uint8_t entropy[KYBER_ENCAP_ENTROPY];
   RAND_bytes(entropy, KYBER_ENCAP_ENTROPY);
-  KYBER_encap_external_entropy(out_ciphertext, out_shared_secret,
-                               out_shared_secret_len, public_key, entropy);
+  KYBER_encap_external_entropy(out_ciphertext, out_shared_secret, public_key,
+                               entropy);
 }
 
 // Algorithm 8 of the Kyber spec, safe for line 2 of the spec. The spec there
@@ -696,8 +712,9 @@ void KYBER_encap(uint8_t out_ciphertext[KYBER_CIPHERTEXT_BYTES],
 // number generator is used, the caller should switch to a secure one before
 // calling this method.
 void KYBER_encap_external_entropy(
-    uint8_t out_ciphertext[KYBER_CIPHERTEXT_BYTES], uint8_t *out_shared_secret,
-    size_t out_shared_secret_len, const struct KYBER_public_key *public_key,
+    uint8_t out_ciphertext[KYBER_CIPHERTEXT_BYTES],
+    uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
+    const struct KYBER_public_key *public_key,
     const uint8_t entropy[KYBER_ENCAP_ENTROPY]) {
   const struct public_key *pub = public_key_from_external(public_key);
   uint8_t input[64];
@@ -705,14 +722,11 @@ void KYBER_encap_external_entropy(
   OPENSSL_memcpy(input + KYBER_ENCAP_ENTROPY, pub->public_key_hash,
                  sizeof(input) - KYBER_ENCAP_ENTROPY);
   uint8_t prekey_and_randomness[64];
-  BORINGSSL_keccak(prekey_and_randomness, sizeof(prekey_and_randomness), input,
-                   sizeof(input), boringssl_sha3_512);
+  hash_g(prekey_and_randomness, input, sizeof(input));
   encrypt_cpa(out_ciphertext, pub, entropy, prekey_and_randomness + 32);
-  BORINGSSL_keccak(prekey_and_randomness + 32, 32, out_ciphertext,
-                   KYBER_CIPHERTEXT_BYTES, boringssl_sha3_256);
-  BORINGSSL_keccak(out_shared_secret, out_shared_secret_len,
-                   prekey_and_randomness, sizeof(prekey_and_randomness),
-                   boringssl_shake256);
+  hash_h(prekey_and_randomness + 32, out_ciphertext, KYBER_CIPHERTEXT_BYTES);
+  kdf(out_shared_secret, KYBER_SHARED_SECRET_BYTES, prekey_and_randomness,
+      sizeof(prekey_and_randomness));
 }
 
 // Algorithm 6 of the Kyber spec.
@@ -738,7 +752,7 @@ static void decrypt_cpa(uint8_t out[32], const struct private_key *priv,
 // failure to be passed on to the caller, and instead returns a result that is
 // deterministic but unpredictable to anyone without knowledge of the private
 // key.
-void KYBER_decap(uint8_t *out_shared_secret, size_t out_shared_secret_len,
+void KYBER_decap(uint8_t out_shared_secret[KYBER_SHARED_SECRET_BYTES],
                  const uint8_t ciphertext[KYBER_CIPHERTEXT_BYTES],
                  const struct KYBER_private_key *private_key) {
   const struct private_key *priv = private_key_from_external(private_key);
@@ -747,8 +761,7 @@ void KYBER_decap(uint8_t *out_shared_secret, size_t out_shared_secret_len,
   OPENSSL_memcpy(decrypted + 32, priv->pub.public_key_hash,
                  sizeof(decrypted) - 32);
   uint8_t prekey_and_randomness[64];
-  BORINGSSL_keccak(prekey_and_randomness, sizeof(prekey_and_randomness),
-                   decrypted, sizeof(decrypted), boringssl_sha3_512);
+  hash_g(prekey_and_randomness, decrypted, sizeof(decrypted));
   uint8_t expected_ciphertext[KYBER_CIPHERTEXT_BYTES];
   encrypt_cpa(expected_ciphertext, &priv->pub, decrypted,
               prekey_and_randomness + 32);
@@ -761,10 +774,8 @@ void KYBER_decap(uint8_t *out_shared_secret, size_t out_shared_secret_len,
     input[i] = constant_time_select_8(mask, prekey_and_randomness[i],
                                       priv->fo_failure_secret[i]);
   }
-  BORINGSSL_keccak(input + 32, 32, ciphertext, KYBER_CIPHERTEXT_BYTES,
-                   boringssl_sha3_256);
-  BORINGSSL_keccak(out_shared_secret, out_shared_secret_len, input,
-                   sizeof(input), boringssl_shake256);
+  hash_h(input + 32, ciphertext, KYBER_CIPHERTEXT_BYTES);
+  kdf(out_shared_secret, KYBER_SHARED_SECRET_BYTES, input, sizeof(input));
 }
 
 int KYBER_marshal_public_key(CBB *out,
@@ -792,8 +803,7 @@ int KYBER_parse_public_key(struct KYBER_public_key *public_key, CBS *in) {
       CBS_len(in) != 0) {
     return 0;
   }
-  BORINGSSL_keccak(pub->public_key_hash, sizeof(pub->public_key_hash),
-                   CBS_data(&orig_in), CBS_len(&orig_in), boringssl_sha3_256);
+  hash_h(pub->public_key_hash, CBS_data(&orig_in), CBS_len(&orig_in));
   return 1;
 }
 

data/third_party/boringssl-with-bazel/src/crypto/lhash/lhash.c

@@ -104,19 +104,17 @@ struct lhash_st {
 };
 
 _LHASH *OPENSSL_lh_new(lhash_hash_func hash, lhash_cmp_func comp) {
-  _LHASH *ret = OPENSSL_malloc(sizeof(_LHASH));
+  _LHASH *ret = OPENSSL_zalloc(sizeof(_LHASH));
   if (ret == NULL) {
     return NULL;
   }
-  OPENSSL_memset(ret, 0, sizeof(_LHASH));
 
   ret->num_buckets = kMinNumBuckets;
-  ret->buckets = OPENSSL_malloc(sizeof(LHASH_ITEM *) * ret->num_buckets);
+  ret->buckets = OPENSSL_calloc(ret->num_buckets, sizeof(LHASH_ITEM *));
   if (ret->buckets == NULL) {
     OPENSSL_free(ret);
     return NULL;
   }
-  OPENSSL_memset(ret->buckets, 0, sizeof(LHASH_ITEM *) * ret->num_buckets);
 
   ret->comp = comp;
   ret->hash = hash;
@@ -214,11 +212,10 @@ static void lh_rebucket(_LHASH *lh, const size_t new_num_buckets) {
     return;
   }
 
-  new_buckets = OPENSSL_malloc(alloc_size);
+  new_buckets = OPENSSL_zalloc(alloc_size);
   if (new_buckets == NULL) {
     return;
   }
-  OPENSSL_memset(new_buckets, 0, alloc_size);
 
   for (i = 0; i < lh->num_buckets; i++) {
     for (cur = lh->buckets[i]; cur != NULL; cur = next) {

data/third_party/boringssl-with-bazel/src/crypto/mem.c

@@ -133,31 +133,6 @@ WEAK_SYMBOL_FUNC(void *, OPENSSL_memory_alloc, (size_t size));
 WEAK_SYMBOL_FUNC(void, OPENSSL_memory_free, (void *ptr));
 WEAK_SYMBOL_FUNC(size_t, OPENSSL_memory_get_size, (void *ptr));
 
-// kBoringSSLBinaryTag is a distinctive byte sequence to identify binaries that
-// are linking in BoringSSL and, roughly, what version they are using.
-static const uint8_t kBoringSSLBinaryTag[18] = {
-    // 16 bytes of magic tag.
-    0x8c,
-    0x62,
-    0x20,
-    0x0b,
-    0xd2,
-    0xa0,
-    0x72,
-    0x58,
-    0x44,
-    0xa8,
-    0x96,
-    0x69,
-    0xad,
-    0x55,
-    0x7e,
-    0xec,
-    // Current source iteration. Incremented ~monthly.
-    3,
-    0,
-};
-
 #if defined(BORINGSSL_MALLOC_FAILURE_TESTING)
 static CRYPTO_MUTEX malloc_failure_lock = CRYPTO_MUTEX_INIT;
 static uint64_t current_malloc_count = 0;
@@ -240,14 +215,6 @@ void *OPENSSL_malloc(size_t size) {
   }
 
   if (size + OPENSSL_MALLOC_PREFIX < size) {
-    // |OPENSSL_malloc| is a central function in BoringSSL thus a reference to
-    // |kBoringSSLBinaryTag| is created here so that the tag isn't discarded by
-    // the linker. The following is sufficient to stop GCC, Clang, and MSVC
-    // optimising away the reference at the time of writing. Since this
-    // probably results in an actual memory reference, it is put in this very
-    // rare code path.
-    uint8_t unused = *(volatile uint8_t *)kBoringSSLBinaryTag;
-    (void) unused;
     goto err;
   }
 
@@ -267,6 +234,23 @@ void *OPENSSL_malloc(size_t size) {
   return NULL;
 }
 
+void *OPENSSL_zalloc(size_t size) {
+  void *ret = OPENSSL_malloc(size);
+  if (ret != NULL) {
+    OPENSSL_memset(ret, 0, size);
+  }
+  return ret;
+}
+
+void *OPENSSL_calloc(size_t num, size_t size) {
+  if (size != 0 && num > SIZE_MAX / size) {
+    OPENSSL_PUT_ERROR(CRYPTO, ERR_R_OVERFLOW);
+    return NULL;
+  }
+
+  return OPENSSL_zalloc(num * size);
+}
+
 void OPENSSL_free(void *orig_ptr) {
   if (orig_ptr == NULL) {
     return;